feat(web): add create_skill, update_skill, and list_skills tools to MCP and Ask Sourcebot#1612

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jsourcebot merged 4 commits into from
Aug 20, 2026
Merged

feat(web): add create_skill, update_skill, and list_skills tools to MCP and Ask Sourcebot #1612

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1c8368d
feat(web): add create_skill, update_skill, and list_skills tools to M…
jsourcebot Aug 20, 2026
aac1bb8
fix(web): reject repository-scoped access tokens in skill tools
jsourcebot Aug 20, 2026
6c0a779
docs: link skill tools changelog entry to PR
jsourcebot Aug 20, 2026
88c472f
docs: reword MCP skill tool sections in second person
jsourcebot Aug 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

### Added
- [EE] Added a `list_branches` tool to the MCP server and Ask Sourcebot for discovering repository branches and whether they are indexed. [#1609](https://github.com/sourcebot-dev/sourcebot/pull/1609)
- [EE] Added `create_skill`, `update_skill`, and `list_skills` tools to the MCP server and Ask Sourcebot for managing skills. [#1612](https://github.com/sourcebot-dev/sourcebot/pull/1612)

### Changed
- Migrated connection syncing, repository indexing, permission syncing, and background pruning from in-process managers and pollers to BullMQ workloads with retries and per-resource execution locking. [#1427](https://github.com/sourcebot-dev/sourcebot/pull/1427)
Expand Down
41 changes: 41 additions & 0 deletions docs/docs/features/mcp-server.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -452,3 +452,44 @@ Parameters:
| `repos` | no | The repositories that are accessible to the agent during the chat. If not provided, all repositories are accessible. |
| `languageModel` | no | The language model to use for answering the question. Object with `provider` and `model`. If not provided, defaults to the first model in the config. Use `list_language_models` to see available options. |
| `visibility` | no | The visibility of the chat session (`'PRIVATE'` or `'PUBLIC'`). Defaults to `PRIVATE` for authenticated users and `PUBLIC` for anonymous users. Set to `PUBLIC` to make the chat viewable by anyone with the link (useful in shared environments like Slack). |

### `create_skill`

You can create an agent skill: a reusable set of instructions you invoke in Ask Sourcebot as a `/<slug>` slash command, or that the agent loads automatically when your request matches its description. The skill is personal to you and enabled immediately. The result includes a link to the skill in **Settings → Skills**.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:---------------|:---------|:------------|
| `name` | yes | Display name for the skill (1-80 characters). |
| `slug` | yes | Slash command for the skill, without the leading `/`. Lowercase letters, numbers, and hyphens; at most 64 characters. Must be unique among the user's skills. |
| `description` | yes | When to use the skill (1-500 characters). Used by the agent to auto-load the skill. |
| `instructions` | yes | Markdown instructions the agent follows when the skill is invoked (1-20,000 characters). |

### `update_skill`

You can edit an existing skill in place. Fields you omit keep their current values. You can edit your personal skills, and shared skills only if you created them and they are enabled. Skills synced from a repository file are rejected; edit those in **Settings → Skills**. This tool never enables or disables a skill, and never moves it between the personal and shared catalogs.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:---------------|:---------|:------------|
| `slug` | yes | Current slash command of the skill to update, without the leading `/`. |
| `scope` | yes | Which catalog the skill lives in: `personal` or `shared`. |
| `name` | no | New display name (1-80 characters). |
| `newSlug` | no | New slash command, without the leading `/`. Lowercase letters, numbers, and hyphens; at most 64 characters. |
| `description` | no | New description of when to use the skill (1-500 characters). |
| `instructions` | no | New markdown instructions (1-20,000 characters). |

### `list_skills`

You can list the skills visible to you: your personal skills plus your organization's shared catalog. Each row includes `slug` and `scope` (the pair `update_skill` needs), `enabled`, `isSynced` (linked to a repository file), `canEdit` (whether `update_skill` can edit it), and, on shared rows, `adopted`. Skill instructions are never included.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:--------|:---------|:------------|
| `scope` | no | Filter to one catalog: `personal` or `shared`. Omit to list both. |
10 changes: 8 additions & 2 deletions packages/web/src/app/api/(server)/ee/mcp/route.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -75,7 +75,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
}

const response = await sew(() =>
withOptionalAuth(async ({ user }) => {
withOptionalAuth(async ({ user, principal }) => {
if (env.EXPERIMENT_ASK_GH_ENABLED === 'true' && !user) {
return notAuthenticated();
}
Expand DownExpand Up@@ -111,7 +111,13 @@ export const POST = apiHandler(async (request: NextRequest) => {
},
});

const mcpServer = await createMcpServer();
// Repository-scoped access tokens never get the skill management
// tools: their documented authorization boundary is the selected
// repositories only. The tools also reject scoped principals
// per-request, since a session is keyed by owner, not principal.
const mcpServer = await createMcpServer({
canManageSkills: ownerId !== null && principal?.source !== 'scoped_access_token',
});
await mcpServer.connect(transport);

return transport.handleRequest(request);
Expand Down
26 changes: 26 additions & 0 deletions packages/web/src/ee/features/chat/agent.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -89,6 +89,9 @@ vi.mock('@/features/tools', () => {
listReposDefinition: createToolDefinition('list_repos'),
listTreeDefinition: createToolDefinition('list_tree'),
readFileDefinition: createToolDefinition('read_file'),
createSkillDefinition: createToolDefinition('create_skill'),
updateSkillDefinition: createToolDefinition('update_skill'),
listSkillsDefinition: createToolDefinition('list_skills'),
toVercelAITool: vi.fn((definition: { name: string }) => ({
name: definition.name,
})),
Expand DownExpand Up@@ -273,6 +276,29 @@ describe('createMessageStream built-in tools', () => {
expect(tools).toHaveProperty('list_branches');
expect(activeTools).toContain('list_branches');
});

test('makes the skill management tools available to authenticated, interactive requesters', async () => {
const { tools, activeTools } = await runCreateMessageStream([createUserMessage()], {
userId: 'user-1',
orgId: 1,
});

for (const toolName of ['create_skill', 'update_skill', 'list_skills']) {
expect(tools).toHaveProperty(toolName);
expect(activeTools).toContain(toolName);
}
});

test('omits the skill management tools when the requester is anonymous or programmatic', async () => {
const { tools, activeTools } = await runCreateMessageStream([createUserMessage()]);

for (const toolName of ['create_skill', 'update_skill', 'list_skills']) {
expect(tools).not.toHaveProperty(toolName);
expect(activeTools).not.toContain(toolName);
}
// The other built-ins are unaffected by the gate.
expect(tools).toHaveProperty('list_branches');
});
});

describe('createMessageStream approval continuation', () => {
Expand Down
18 changes: 17 additions & 1 deletion packages/web/src/ee/features/chat/agent.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -24,6 +24,7 @@ import { ANSWER_TAG, FILE_REFERENCE_PREFIX } from "@/features/chat/constants";
import { Source } from "@/features/chat/types";
import { addLineNumbers, fileReferenceToString, formatAttachmentsForPrompt, getAnswerPartFromAssistantMessage, getTurnProgressState, getUserMessageAttachments, getUserMessageText } from "@/features/chat/utils";
import { createTools } from "./tools";
import { createSkillDefinition, listSkillsDefinition, updateSkillDefinition } from "@/features/tools";
import { getConnectedMcpClients } from "@/ee/features/chat/mcp/mcpClientFactory";
import { getMcpTools, McpToolsResult } from "@/ee/features/chat/mcp/mcpToolSets";
import {
Expand DownExpand Up@@ -692,7 +693,22 @@ const createAgentStream = async ({
skillRegistry,
});

const builtinTools = createTools({ source: 'sourcebot-ask-agent', selectedRepos: sortedRepos });
const allBuiltinTools = createTools({ source: 'sourcebot-ask-agent', selectedRepos: sortedRepos });

// The skill management tools require an interactive, authenticated
// requester: same gate as load_skill. This also excludes programmatic runs
// (askCodebase, /api/chat/blocking) where nobody can answer an approval
// request.
const skillManagementToolNames: string[] = [
createSkillDefinition.name,
updateSkillDefinition.name,
listSkillsDefinition.name,
];
const builtinTools: Record<string, Tool> = (userId !== undefined && orgId !== undefined)
? allBuiltinTools
: Object.fromEntries(
Object.entries(allBuiltinTools).filter(([name]) => !skillManagementToolNames.includes(name)),
);
const builtinToolNames = Object.keys(builtinTools);
const allTools: Record<string, Tool> = {
...builtinTools,
Expand Down
11 changes: 11 additions & 0 deletions packages/web/src/ee/features/chat/askCommandsContext.tsx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
'use client';

import { createContext, useContext } from 'react';
import type { AskCommandDefinition } from '@/features/chat/commands/types';

// The chat page's server-rendered slash-command catalog, made available to
// nested chat components (e.g. the tool approval banner resolves a skill's
// display name from its slug + scope).
export const AskCommandsContext = createContext<AskCommandDefinition[]>([]);

export const useAskCommands = () => useContext(AskCommandsContext);
3 changes: 3 additions & 0 deletions packages/web/src/ee/features/chat/components/chatThread/chatThread.tsx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -33,6 +33,7 @@ import { McpReconnectContext } from '../../mcpReconnectContext';
import { McpAuthRequiredData, McpServerLoadFailureData, useMcpReconnectController } from './useMcpReconnectController';
import { McpReconnectBanner } from './mcpReconnectBanner';
import { ToolApprovalProvider } from '../../toolApprovalContext';
import { AskCommandsContext } from '../../askCommandsContext';
import useCaptureEvent from '@/hooks/useCaptureEvent';
import { SignInPromptBanner } from './signInPromptBanner';
import { DuplicateChatDialog } from '@/app/(app)/chat/components/duplicateChatDialog';
Expand DownExpand Up@@ -459,6 +460,7 @@ export const ChatThread = ({

return (
<ToolApprovalProvider value={addToolApprovalResponse}>
<AskCommandsContext.Provider value={askCommands}>
<McpReconnectContext.Provider value={mcpReconnectContextValue}>
<McpServerIconContext.Provider value={mcpServerIconMap}>
<McpToolNameContext.Provider value={mcpToolNameMap}>
Expand DownExpand Up@@ -615,6 +617,7 @@ export const ChatThread = ({
</McpToolNameContext.Provider>
</McpServerIconContext.Provider>
</McpReconnectContext.Provider>
</AskCommandsContext.Provider>
</ToolApprovalProvider>
);
}
184 changes: 184 additions & 0 deletions packages/web/src/ee/features/chat/components/chatThread/detailsCard.test.tsx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -194,6 +194,190 @@ describe('DetailsCard', () => {
expect(screen.queryByText('Look for correctness issues first.')).toBeNull();
});

test('renders a create_skill success summary with the name and command', () => {
const createSkillPart = {
type: 'tool-create_skill',
toolCallId: 'tool-call-create-skill',
state: 'output-available',
input: {
name: 'Review PR',
slug: 'review-pr',
description: 'Review a pull request.',
instructions: 'Look for correctness issues first.',
},
output: {
output: '{}',
metadata: {
id: 'skill-1',
slug: 'review-pr',
name: 'Review PR',
url: 'https://sourcebot.example.com/settings/skills?skill=skill-1',
},
},
} satisfies SBChatMessagePart;

const { container } = render(
<TooltipProvider>
<DetailsCard
chatId="chat-id"
isExpanded={true}
onExpandedChanged={vi.fn()}
isThinking={false}
isTurnInProgress={false}
isNetworkActive={false}
isAwaitingToolApproval={false}
thinkingSteps={[{ stepIndex: 0, parts: [createSkillPart] }]}
/>
</TooltipProvider>
);

expect(container.textContent).toContain('Created skill');
expect(container.textContent).toContain('Review PR');
expect(container.textContent).toContain('/review-pr');
expect(screen.queryByText('Creating skill...')).toBeNull();
});

test('renders an update_skill success summary with the name and command', () => {
const updateSkillPart = {
type: 'tool-update_skill',
toolCallId: 'tool-call-update-skill',
state: 'output-available',
input: {
slug: 'review-pr',
scope: 'shared',
name: 'Review PR v2',
},
output: {
output: '{}',
metadata: {
id: 'skill-1',
slug: 'review-pr',
name: 'Review PR v2',
scope: 'shared',
url: 'https://sourcebot.example.com/settings/skills?skill=skill-1',
},
},
} satisfies SBChatMessagePart;

const { container } = render(
<TooltipProvider>
<DetailsCard
chatId="chat-id"
isExpanded={true}
onExpandedChanged={vi.fn()}
isThinking={false}
isTurnInProgress={false}
isNetworkActive={false}
isAwaitingToolApproval={false}
thinkingSteps={[{ stepIndex: 0, parts: [updateSkillPart] }]}
/>
</TooltipProvider>
);

expect(container.textContent).toContain('Updated shared skill');
expect(container.textContent).toContain('Review PR v2');
expect(container.textContent).toContain('/review-pr');
expect(screen.queryByText('Updating skill...')).toBeNull();
});

test('renders a list_skills count summary', () => {
const listSkillsPart = {
type: 'tool-list_skills',
toolCallId: 'tool-call-list-skills',
state: 'output-available',
input: {},
output: {
output: '{"skills":[]}',
metadata: { count: 3 },
},
} satisfies SBChatMessagePart;

render(
<TooltipProvider>
<DetailsCard
chatId="chat-id"
isExpanded={true}
onExpandedChanged={vi.fn()}
isThinking={false}
isTurnInProgress={false}
isNetworkActive={false}
isAwaitingToolApproval={false}
thinkingSteps={[{ stepIndex: 0, parts: [listSkillsPart] }]}
/>
</TooltipProvider>
);

expect(screen.queryByText('Listed skills')).toBeTruthy();
expect(screen.queryByText('3 skills')).toBeTruthy();
});

test('shows a non-pulsing waiting state for an approval-requested tool call', () => {
const approvalRequestedPart = {
type: 'tool-create_skill',
toolCallId: 'tool-call-approval',
state: 'approval-requested',
input: {
name: 'Review PR',
slug: 'review-pr',
description: 'Review a pull request.',
instructions: 'Look for correctness issues first.',
},
approval: { id: 'approval-1' },
} satisfies SBChatMessagePart;

render(
<TooltipProvider>
<DetailsCard
chatId="chat-id"
isExpanded={true}
onExpandedChanged={vi.fn()}
isThinking={false}
isTurnInProgress={true}
isNetworkActive={false}
isAwaitingToolApproval={true}
thinkingSteps={[{ stepIndex: 0, parts: [approvalRequestedPart] }]}
/>
</TooltipProvider>
);

expect(screen.queryByText('Waiting for approval')).toBeTruthy();
expect(screen.queryByText('Creating skill...')).toBeNull();
});

test('shows a denied label for an output-denied tool call', () => {
const deniedPart = {
type: 'tool-create_skill',
toolCallId: 'tool-call-denied',
title: 'Create skill',
state: 'output-denied',
input: {
name: 'Review PR',
slug: 'review-pr',
description: 'Review a pull request.',
instructions: 'Look for correctness issues first.',
},
approval: { id: 'approval-1', approved: false, reason: 'User denied' },
} satisfies SBChatMessagePart;

render(
<TooltipProvider>
<DetailsCard
chatId="chat-id"
isExpanded={true}
onExpandedChanged={vi.fn()}
isThinking={false}
isTurnInProgress={false}
isNetworkActive={false}
isAwaitingToolApproval={false}
thinkingSteps={[{ stepIndex: 0, parts: [deniedPart] }]}
/>
</TooltipProvider>
);

expect(screen.queryByText('Create skill denied')).toBeTruthy();
expect(screen.queryByText('Creating skill...')).toBeNull();
});

test('renders an unavailable skill load instead of a silent no-op', () => {
const unavailableSkillPart = {
type: 'tool-load_skill',
Expand Down
Loading
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
feat(web): add create_skill, update_skill, and list_skills tools to MCP and Ask Sourcebot#1612

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

jsourcebot
merged 4 commits into

from

Aug 20, 2026
 Merged


feat(web): add create_skill, update_skill, and list_skills tools to MCP and Ask Sourcebot
#1612
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


4 commits


Select commit
Hold shift + click to select a range
1c8368d

feat(web): add create_skill, update_skill, and list_skills tools to M…


jsourcebot Aug 20, 2026
aac1bb8

fix(web): reject repository-scoped access tokens in skill tools


jsourcebot Aug 20, 2026
6c0a779

docs: link skill tools changelog entry to PR


jsourcebot Aug 20, 2026
88c472f

docs: reword MCP skill tool sections in second person


jsourcebot Aug 20, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


1 change: 1 addition & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

### Added
- [EE] Added a `list_branches` tool to the MCP server and Ask Sourcebot for discovering repository branches and whether they are indexed. [#1609](https://github.com/sourcebot-dev/sourcebot/pull/1609)
- [EE] Added `create_skill`, `update_skill`, and `list_skills` tools to the MCP server and Ask Sourcebot for managing skills. [#1612](https://github.com/sourcebot-dev/sourcebot/pull/1612)

### Changed
- Migrated connection syncing, repository indexing, permission syncing, and background pruning from in-process managers and pollers to BullMQ workloads with retries and per-resource execution locking. [#1427](https://github.com/sourcebot-dev/sourcebot/pull/1427)
Expand Down

41 changes: 41 additions & 0 deletions
docs/docs/features/mcp-server.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -452,3 +452,44 @@ Parameters:
| `repos` | no | The repositories that are accessible to the agent during the chat. If not provided, all repositories are accessible. |
| `languageModel` | no | The language model to use for answering the question. Object with `provider` and `model`. If not provided, defaults to the first model in the config. Use `list_language_models` to see available options. |
| `visibility` | no | The visibility of the chat session (`'PRIVATE'` or `'PUBLIC'`). Defaults to `PRIVATE` for authenticated users and `PUBLIC` for anonymous users. Set to `PUBLIC` to make the chat viewable by anyone with the link (useful in shared environments like Slack). |

### `create_skill`

You can create an agent skill: a reusable set of instructions you invoke in Ask Sourcebot as a `/<slug>` slash command, or that the agent loads automatically when your request matches its description. The skill is personal to you and enabled immediately. The result includes a link to the skill in **Settings → Skills**.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:---------------|:---------|:------------|
| `name` | yes | Display name for the skill (1-80 characters). |
| `slug` | yes | Slash command for the skill, without the leading `/`. Lowercase letters, numbers, and hyphens; at most 64 characters. Must be unique among the user's skills. |
| `description` | yes | When to use the skill (1-500 characters). Used by the agent to auto-load the skill. |
| `instructions` | yes | Markdown instructions the agent follows when the skill is invoked (1-20,000 characters). |

### `update_skill`

You can edit an existing skill in place. Fields you omit keep their current values. You can edit your personal skills, and shared skills only if you created them and they are enabled. Skills synced from a repository file are rejected; edit those in **Settings → Skills**. This tool never enables or disables a skill, and never moves it between the personal and shared catalogs.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:---------------|:---------|:------------|
| `slug` | yes | Current slash command of the skill to update, without the leading `/`. |
| `scope` | yes | Which catalog the skill lives in: `personal` or `shared`. |
| `name` | no | New display name (1-80 characters). |
| `newSlug` | no | New slash command, without the leading `/`. Lowercase letters, numbers, and hyphens; at most 64 characters. |
| `description` | no | New description of when to use the skill (1-500 characters). |
| `instructions` | no | New markdown instructions (1-20,000 characters). |

### `list_skills`

You can list the skills visible to you: your personal skills plus your organization's shared catalog. Each row includes `slug` and `scope` (the pair `update_skill` needs), `enabled`, `isSynced` (linked to a repository file), `canEdit` (whether `update_skill` can edit it), and, on shared rows, `adopted`. Skill instructions are never included.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:--------|:---------|:------------|
| `scope` | no | Filter to one catalog: `personal` or `shared`. Omit to list both. |

10 changes: 8 additions & 2 deletions
packages/web/src/app/api/(server)/ee/mcp/route.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -75,7 +75,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
 }

 const response = await sew(() =>
 withOptionalAuth(async ({ user }) => {
 withOptionalAuth(async ({ user, principal }) => {
 if (env.EXPERIMENT_ASK_GH_ENABLED === 'true' && !user) {
 return notAuthenticated();
 }
Expand DownExpand Up@@ -111,7 +111,13 @@ export const POST = apiHandler(async (request: NextRequest) => {
 },
 });

 const mcpServer = await createMcpServer();
 // Repository-scoped access tokens never get the skill management
 // tools: their documented authorization boundary is the selected
 // repositories only. The tools also reject scoped principals
 // per-request, since a session is keyed by owner, not principal.
 const mcpServer = await createMcpServer({
 canManageSkills: ownerId !== null && principal?.source !== 'scoped_access_token',
 });
 await mcpServer.connect(transport);

 return transport.handleRequest(request);
Expand Down

26 changes: 26 additions & 0 deletions
packages/web/src/ee/features/chat/agent.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -89,6 +89,9 @@ vi.mock('@/features/tools', () => {
 listReposDefinition: createToolDefinition('list_repos'),
 listTreeDefinition: createToolDefinition('list_tree'),
 readFileDefinition: createToolDefinition('read_file'),
 createSkillDefinition: createToolDefinition('create_skill'),
 updateSkillDefinition: createToolDefinition('update_skill'),
 listSkillsDefinition: createToolDefinition('list_skills'),
 toVercelAITool: vi.fn((definition: { name: string }) => ({
 name: definition.name,
 })),
Expand DownExpand Up@@ -273,6 +276,29 @@ describe('createMessageStream built-in tools', () => {
 expect(tools).toHaveProperty('list_branches');
 expect(activeTools).toContain('list_branches');
 });

 test('makes the skill management tools available to authenticated, interactive requesters', async () => {
 const { tools, activeTools } = await runCreateMessageStream([createUserMessage()], {
 userId: 'user-1',
 orgId: 1,
 });

 for (const toolName of ['create_skill', 'update_skill', 'list_skills']) {
 expect(tools).toHaveProperty(toolName);
 expect(activeTools).toContain(toolName);
 }
 });

 test('omits the skill management tools when the requester is anonymous or programmatic', async () => {
 const { tools, activeTools } = await runCreateMessageStream([createUserMessage()]);

 for (const toolName of ['create_skill', 'update_skill', 'list_skills']) {
 expect(tools).not.toHaveProperty(toolName);
 expect(activeTools).not.toContain(toolName);
 }
 // The other built-ins are unaffected by the gate.
 expect(tools).toHaveProperty('list_branches');
 });
});

describe('createMessageStream approval continuation', () => {
Expand Down

18 changes: 17 additions & 1 deletion
packages/web/src/ee/features/chat/agent.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -24,6 +24,7 @@ import { ANSWER_TAG, FILE_REFERENCE_PREFIX } from "@/features/chat/constants";
import { Source } from "@/features/chat/types";
import { addLineNumbers, fileReferenceToString, formatAttachmentsForPrompt, getAnswerPartFromAssistantMessage, getTurnProgressState, getUserMessageAttachments, getUserMessageText } from "@/features/chat/utils";
import { createTools } from "./tools";
import { createSkillDefinition, listSkillsDefinition, updateSkillDefinition } from "@/features/tools";
import { getConnectedMcpClients } from "@/ee/features/chat/mcp/mcpClientFactory";
import { getMcpTools, McpToolsResult } from "@/ee/features/chat/mcp/mcpToolSets";
import {
Expand DownExpand Up@@ -692,7 +693,22 @@ const createAgentStream = async ({
 skillRegistry,
 });

 const builtinTools = createTools({ source: 'sourcebot-ask-agent', selectedRepos: sortedRepos });
 const allBuiltinTools = createTools({ source: 'sourcebot-ask-agent', selectedRepos: sortedRepos });

 // The skill management tools require an interactive, authenticated
 // requester: same gate as load_skill. This also excludes programmatic runs
 // (askCodebase, /api/chat/blocking) where nobody can answer an approval
 // request.
 const skillManagementToolNames: string[] = [
 createSkillDefinition.name,
 updateSkillDefinition.name,
 listSkillsDefinition.name,
 ];
 const builtinTools: Record<string, Tool> = (userId !== undefined && orgId !== undefined)
 ? allBuiltinTools
 : Object.fromEntries(
 Object.entries(allBuiltinTools).filter(([name]) => !skillManagementToolNames.includes(name)),
 );
 const builtinToolNames = Object.keys(builtinTools);
 const allTools: Record<string, Tool> = {
 ...builtinTools,
Expand Down

11 changes: 11 additions & 0 deletions
packages/web/src/ee/features/chat/askCommandsContext.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
'use client';

import { createContext, useContext } from 'react';
import type { AskCommandDefinition } from '@/features/chat/commands/types';

// The chat page's server-rendered slash-command catalog, made available to
// nested chat components (e.g. the tool approval banner resolves a skill's
// display name from its slug + scope).
export const AskCommandsContext = createContext<AskCommandDefinition[]>([]);

export const useAskCommands = () => useContext(AskCommandsContext);

3 changes: 3 additions & 0 deletions
packages/web/src/ee/features/chat/components/chatThread/chatThread.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -33,6 +33,7 @@ import { McpReconnectContext } from '../../mcpReconnectContext';
import { McpAuthRequiredData, McpServerLoadFailureData, useMcpReconnectController } from './useMcpReconnectController';
import { McpReconnectBanner } from './mcpReconnectBanner';
import { ToolApprovalProvider } from '../../toolApprovalContext';
import { AskCommandsContext } from '../../askCommandsContext';
import useCaptureEvent from '@/hooks/useCaptureEvent';
import { SignInPromptBanner } from './signInPromptBanner';
import { DuplicateChatDialog } from '@/app/(app)/chat/components/duplicateChatDialog';
Expand DownExpand Up@@ -459,6 +460,7 @@ export const ChatThread = ({

 return (
 <ToolApprovalProvider value={addToolApprovalResponse}>
 <AskCommandsContext.Provider value={askCommands}>
 <McpReconnectContext.Provider value={mcpReconnectContextValue}>
 <McpServerIconContext.Provider value={mcpServerIconMap}>
 <McpToolNameContext.Provider value={mcpToolNameMap}>
Expand DownExpand Up@@ -615,6 +617,7 @@ export const ChatThread = ({
 </McpToolNameContext.Provider>
 </McpServerIconContext.Provider>
 </McpReconnectContext.Provider>
 </AskCommandsContext.Provider>
 </ToolApprovalProvider>
 );
}

184 changes: 184 additions & 0 deletions
packages/web/src/ee/features/chat/components/chatThread/detailsCard.test.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -194,6 +194,190 @@ describe('DetailsCard', () => {
 expect(screen.queryByText('Look for correctness issues first.')).toBeNull();
 });

 test('renders a create_skill success summary with the name and command', () => {
 const createSkillPart = {
 type: 'tool-create_skill',
 toolCallId: 'tool-call-create-skill',
 state: 'output-available',
 input: {
 name: 'Review PR',
 slug: 'review-pr',
 description: 'Review a pull request.',
 instructions: 'Look for correctness issues first.',
 },
 output: {
 output: '{}',
 metadata: {
 id: 'skill-1',
 slug: 'review-pr',
 name: 'Review PR',
 url: 'https://sourcebot.example.com/settings/skills?skill=skill-1',
 },
 },
 } satisfies SBChatMessagePart;

 const { container } = render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [createSkillPart] }]}
 />
 </TooltipProvider>
 );

 expect(container.textContent).toContain('Created skill');
 expect(container.textContent).toContain('Review PR');
 expect(container.textContent).toContain('/review-pr');
 expect(screen.queryByText('Creating skill...')).toBeNull();
 });

 test('renders an update_skill success summary with the name and command', () => {
 const updateSkillPart = {
 type: 'tool-update_skill',
 toolCallId: 'tool-call-update-skill',
 state: 'output-available',
 input: {
 slug: 'review-pr',
 scope: 'shared',
 name: 'Review PR v2',
 },
 output: {
 output: '{}',
 metadata: {
 id: 'skill-1',
 slug: 'review-pr',
 name: 'Review PR v2',
 scope: 'shared',
 url: 'https://sourcebot.example.com/settings/skills?skill=skill-1',
 },
 },
 } satisfies SBChatMessagePart;

 const { container } = render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [updateSkillPart] }]}
 />
 </TooltipProvider>
 );

 expect(container.textContent).toContain('Updated shared skill');
 expect(container.textContent).toContain('Review PR v2');
 expect(container.textContent).toContain('/review-pr');
 expect(screen.queryByText('Updating skill...')).toBeNull();
 });

 test('renders a list_skills count summary', () => {
 const listSkillsPart = {
 type: 'tool-list_skills',
 toolCallId: 'tool-call-list-skills',
 state: 'output-available',
 input: {},
 output: {
 output: '{"skills":[]}',
 metadata: { count: 3 },
 },
 } satisfies SBChatMessagePart;

 render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [listSkillsPart] }]}
 />
 </TooltipProvider>
 );

 expect(screen.queryByText('Listed skills')).toBeTruthy();
 expect(screen.queryByText('3 skills')).toBeTruthy();
 });

 test('shows a non-pulsing waiting state for an approval-requested tool call', () => {
 const approvalRequestedPart = {
 type: 'tool-create_skill',
 toolCallId: 'tool-call-approval',
 state: 'approval-requested',
 input: {
 name: 'Review PR',
 slug: 'review-pr',
 description: 'Review a pull request.',
 instructions: 'Look for correctness issues first.',
 },
 approval: { id: 'approval-1' },
 } satisfies SBChatMessagePart;

 render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={true}
 isNetworkActive={false}
 isAwaitingToolApproval={true}
 thinkingSteps={[{ stepIndex: 0, parts: [approvalRequestedPart] }]}
 />
 </TooltipProvider>
 );

 expect(screen.queryByText('Waiting for approval')).toBeTruthy();
 expect(screen.queryByText('Creating skill...')).toBeNull();
 });

 test('shows a denied label for an output-denied tool call', () => {
 const deniedPart = {
 type: 'tool-create_skill',
 toolCallId: 'tool-call-denied',
 title: 'Create skill',
 state: 'output-denied',
 input: {
 name: 'Review PR',
 slug: 'review-pr',
 description: 'Review a pull request.',
 instructions: 'Look for correctness issues first.',
 },
 approval: { id: 'approval-1', approved: false, reason: 'User denied' },
 } satisfies SBChatMessagePart;

 render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [deniedPart] }]}
 />
 </TooltipProvider>
 );

 expect(screen.queryByText('Create skill denied')).toBeTruthy();
 expect(screen.queryByText('Creating skill...')).toBeNull();
 });

 test('renders an unavailable skill load instead of a silent no-op', () => {
 const unavailableSkillPart = {
 type: 'tool-load_skill',
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(web): add create_skill, update_skill, and list_skills tools to MCP and Ask Sourcebot#1612

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

jsourcebot
merged 4 commits into

from

Aug 20, 2026
 Merged


feat(web): add create_skill, update_skill, and list_skills tools to MCP and Ask Sourcebot
#1612
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


4 commits


Select commit
Hold shift + click to select a range
1c8368d

feat(web): add create_skill, update_skill, and list_skills tools to M…


jsourcebot Aug 20, 2026
aac1bb8

fix(web): reject repository-scoped access tokens in skill tools


jsourcebot Aug 20, 2026
6c0a779

docs: link skill tools changelog entry to PR


jsourcebot Aug 20, 2026
88c472f

docs: reword MCP skill tool sections in second person


jsourcebot Aug 20, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


1 change: 1 addition & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

### Added
- [EE] Added a `list_branches` tool to the MCP server and Ask Sourcebot for discovering repository branches and whether they are indexed. [#1609](https://github.com/sourcebot-dev/sourcebot/pull/1609)
- [EE] Added `create_skill`, `update_skill`, and `list_skills` tools to the MCP server and Ask Sourcebot for managing skills. [#1612](https://github.com/sourcebot-dev/sourcebot/pull/1612)

### Changed
- Migrated connection syncing, repository indexing, permission syncing, and background pruning from in-process managers and pollers to BullMQ workloads with retries and per-resource execution locking. [#1427](https://github.com/sourcebot-dev/sourcebot/pull/1427)
Expand Down

41 changes: 41 additions & 0 deletions
docs/docs/features/mcp-server.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -452,3 +452,44 @@ Parameters:
| `repos` | no | The repositories that are accessible to the agent during the chat. If not provided, all repositories are accessible. |
| `languageModel` | no | The language model to use for answering the question. Object with `provider` and `model`. If not provided, defaults to the first model in the config. Use `list_language_models` to see available options. |
| `visibility` | no | The visibility of the chat session (`'PRIVATE'` or `'PUBLIC'`). Defaults to `PRIVATE` for authenticated users and `PUBLIC` for anonymous users. Set to `PUBLIC` to make the chat viewable by anyone with the link (useful in shared environments like Slack). |

### `create_skill`

You can create an agent skill: a reusable set of instructions you invoke in Ask Sourcebot as a `/<slug>` slash command, or that the agent loads automatically when your request matches its description. The skill is personal to you and enabled immediately. The result includes a link to the skill in **Settings → Skills**.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:---------------|:---------|:------------|
| `name` | yes | Display name for the skill (1-80 characters). |
| `slug` | yes | Slash command for the skill, without the leading `/`. Lowercase letters, numbers, and hyphens; at most 64 characters. Must be unique among the user's skills. |
| `description` | yes | When to use the skill (1-500 characters). Used by the agent to auto-load the skill. |
| `instructions` | yes | Markdown instructions the agent follows when the skill is invoked (1-20,000 characters). |

### `update_skill`

You can edit an existing skill in place. Fields you omit keep their current values. You can edit your personal skills, and shared skills only if you created them and they are enabled. Skills synced from a repository file are rejected; edit those in **Settings → Skills**. This tool never enables or disables a skill, and never moves it between the personal and shared catalogs.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:---------------|:---------|:------------|
| `slug` | yes | Current slash command of the skill to update, without the leading `/`. |
| `scope` | yes | Which catalog the skill lives in: `personal` or `shared`. |
| `name` | no | New display name (1-80 characters). |
| `newSlug` | no | New slash command, without the leading `/`. Lowercase letters, numbers, and hyphens; at most 64 characters. |
| `description` | no | New description of when to use the skill (1-500 characters). |
| `instructions` | no | New markdown instructions (1-20,000 characters). |

### `list_skills`

You can list the skills visible to you: your personal skills plus your organization's shared catalog. Each row includes `slug` and `scope` (the pair `update_skill` needs), `enabled`, `isSynced` (linked to a repository file), `canEdit` (whether `update_skill` can edit it), and, on shared rows, `adopted`. Skill instructions are never included.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:--------|:---------|:------------|
| `scope` | no | Filter to one catalog: `personal` or `shared`. Omit to list both. |

10 changes: 8 additions & 2 deletions
packages/web/src/app/api/(server)/ee/mcp/route.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -75,7 +75,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
 }

 const response = await sew(() =>
 withOptionalAuth(async ({ user }) => {
 withOptionalAuth(async ({ user, principal }) => {
 if (env.EXPERIMENT_ASK_GH_ENABLED === 'true' && !user) {
 return notAuthenticated();
 }
Expand DownExpand Up@@ -111,7 +111,13 @@ export const POST = apiHandler(async (request: NextRequest) => {
 },
 });

 const mcpServer = await createMcpServer();
 // Repository-scoped access tokens never get the skill management
 // tools: their documented authorization boundary is the selected
 // repositories only. The tools also reject scoped principals
 // per-request, since a session is keyed by owner, not principal.
 const mcpServer = await createMcpServer({
 canManageSkills: ownerId !== null && principal?.source !== 'scoped_access_token',
 });
 await mcpServer.connect(transport);

 return transport.handleRequest(request);
Expand Down

26 changes: 26 additions & 0 deletions
packages/web/src/ee/features/chat/agent.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -89,6 +89,9 @@ vi.mock('@/features/tools', () => {
 listReposDefinition: createToolDefinition('list_repos'),
 listTreeDefinition: createToolDefinition('list_tree'),
 readFileDefinition: createToolDefinition('read_file'),
 createSkillDefinition: createToolDefinition('create_skill'),
 updateSkillDefinition: createToolDefinition('update_skill'),
 listSkillsDefinition: createToolDefinition('list_skills'),
 toVercelAITool: vi.fn((definition: { name: string }) => ({
 name: definition.name,
 })),
Expand DownExpand Up@@ -273,6 +276,29 @@ describe('createMessageStream built-in tools', () => {
 expect(tools).toHaveProperty('list_branches');
 expect(activeTools).toContain('list_branches');
 });

 test('makes the skill management tools available to authenticated, interactive requesters', async () => {
 const { tools, activeTools } = await runCreateMessageStream([createUserMessage()], {
 userId: 'user-1',
 orgId: 1,
 });

 for (const toolName of ['create_skill', 'update_skill', 'list_skills']) {
 expect(tools).toHaveProperty(toolName);
 expect(activeTools).toContain(toolName);
 }
 });

 test('omits the skill management tools when the requester is anonymous or programmatic', async () => {
 const { tools, activeTools } = await runCreateMessageStream([createUserMessage()]);

 for (const toolName of ['create_skill', 'update_skill', 'list_skills']) {
 expect(tools).not.toHaveProperty(toolName);
 expect(activeTools).not.toContain(toolName);
 }
 // The other built-ins are unaffected by the gate.
 expect(tools).toHaveProperty('list_branches');
 });
});

describe('createMessageStream approval continuation', () => {
Expand Down

18 changes: 17 additions & 1 deletion
packages/web/src/ee/features/chat/agent.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -24,6 +24,7 @@ import { ANSWER_TAG, FILE_REFERENCE_PREFIX } from "@/features/chat/constants";
import { Source } from "@/features/chat/types";
import { addLineNumbers, fileReferenceToString, formatAttachmentsForPrompt, getAnswerPartFromAssistantMessage, getTurnProgressState, getUserMessageAttachments, getUserMessageText } from "@/features/chat/utils";
import { createTools } from "./tools";
import { createSkillDefinition, listSkillsDefinition, updateSkillDefinition } from "@/features/tools";
import { getConnectedMcpClients } from "@/ee/features/chat/mcp/mcpClientFactory";
import { getMcpTools, McpToolsResult } from "@/ee/features/chat/mcp/mcpToolSets";
import {
Expand DownExpand Up@@ -692,7 +693,22 @@ const createAgentStream = async ({
 skillRegistry,
 });

 const builtinTools = createTools({ source: 'sourcebot-ask-agent', selectedRepos: sortedRepos });
 const allBuiltinTools = createTools({ source: 'sourcebot-ask-agent', selectedRepos: sortedRepos });

 // The skill management tools require an interactive, authenticated
 // requester: same gate as load_skill. This also excludes programmatic runs
 // (askCodebase, /api/chat/blocking) where nobody can answer an approval
 // request.
 const skillManagementToolNames: string[] = [
 createSkillDefinition.name,
 updateSkillDefinition.name,
 listSkillsDefinition.name,
 ];
 const builtinTools: Record<string, Tool> = (userId !== undefined && orgId !== undefined)
 ? allBuiltinTools
 : Object.fromEntries(
 Object.entries(allBuiltinTools).filter(([name]) => !skillManagementToolNames.includes(name)),
 );
 const builtinToolNames = Object.keys(builtinTools);
 const allTools: Record<string, Tool> = {
 ...builtinTools,
Expand Down

11 changes: 11 additions & 0 deletions
packages/web/src/ee/features/chat/askCommandsContext.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
'use client';

import { createContext, useContext } from 'react';
import type { AskCommandDefinition } from '@/features/chat/commands/types';

// The chat page's server-rendered slash-command catalog, made available to
// nested chat components (e.g. the tool approval banner resolves a skill's
// display name from its slug + scope).
export const AskCommandsContext = createContext<AskCommandDefinition[]>([]);

export const useAskCommands = () => useContext(AskCommandsContext);

3 changes: 3 additions & 0 deletions
packages/web/src/ee/features/chat/components/chatThread/chatThread.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -33,6 +33,7 @@ import { McpReconnectContext } from '../../mcpReconnectContext';
import { McpAuthRequiredData, McpServerLoadFailureData, useMcpReconnectController } from './useMcpReconnectController';
import { McpReconnectBanner } from './mcpReconnectBanner';
import { ToolApprovalProvider } from '../../toolApprovalContext';
import { AskCommandsContext } from '../../askCommandsContext';
import useCaptureEvent from '@/hooks/useCaptureEvent';
import { SignInPromptBanner } from './signInPromptBanner';
import { DuplicateChatDialog } from '@/app/(app)/chat/components/duplicateChatDialog';
Expand DownExpand Up@@ -459,6 +460,7 @@ export const ChatThread = ({

 return (
 <ToolApprovalProvider value={addToolApprovalResponse}>
 <AskCommandsContext.Provider value={askCommands}>
 <McpReconnectContext.Provider value={mcpReconnectContextValue}>
 <McpServerIconContext.Provider value={mcpServerIconMap}>
 <McpToolNameContext.Provider value={mcpToolNameMap}>
Expand DownExpand Up@@ -615,6 +617,7 @@ export const ChatThread = ({
 </McpToolNameContext.Provider>
 </McpServerIconContext.Provider>
 </McpReconnectContext.Provider>
 </AskCommandsContext.Provider>
 </ToolApprovalProvider>
 );
}

184 changes: 184 additions & 0 deletions
packages/web/src/ee/features/chat/components/chatThread/detailsCard.test.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -194,6 +194,190 @@ describe('DetailsCard', () => {
 expect(screen.queryByText('Look for correctness issues first.')).toBeNull();
 });

 test('renders a create_skill success summary with the name and command', () => {
 const createSkillPart = {
 type: 'tool-create_skill',
 toolCallId: 'tool-call-create-skill',
 state: 'output-available',
 input: {
 name: 'Review PR',
 slug: 'review-pr',
 description: 'Review a pull request.',
 instructions: 'Look for correctness issues first.',
 },
 output: {
 output: '{}',
 metadata: {
 id: 'skill-1',
 slug: 'review-pr',
 name: 'Review PR',
 url: 'https://sourcebot.example.com/settings/skills?skill=skill-1',
 },
 },
 } satisfies SBChatMessagePart;

 const { container } = render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [createSkillPart] }]}
 />
 </TooltipProvider>
 );

 expect(container.textContent).toContain('Created skill');
 expect(container.textContent).toContain('Review PR');
 expect(container.textContent).toContain('/review-pr');
 expect(screen.queryByText('Creating skill...')).toBeNull();
 });

 test('renders an update_skill success summary with the name and command', () => {
 const updateSkillPart = {
 type: 'tool-update_skill',
 toolCallId: 'tool-call-update-skill',
 state: 'output-available',
 input: {
 slug: 'review-pr',
 scope: 'shared',
 name: 'Review PR v2',
 },
 output: {
 output: '{}',
 metadata: {
 id: 'skill-1',
 slug: 'review-pr',
 name: 'Review PR v2',
 scope: 'shared',
 url: 'https://sourcebot.example.com/settings/skills?skill=skill-1',
 },
 },
 } satisfies SBChatMessagePart;

 const { container } = render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [updateSkillPart] }]}
 />
 </TooltipProvider>
 );

 expect(container.textContent).toContain('Updated shared skill');
 expect(container.textContent).toContain('Review PR v2');
 expect(container.textContent).toContain('/review-pr');
 expect(screen.queryByText('Updating skill...')).toBeNull();
 });

 test('renders a list_skills count summary', () => {
 const listSkillsPart = {
 type: 'tool-list_skills',
 toolCallId: 'tool-call-list-skills',
 state: 'output-available',
 input: {},
 output: {
 output: '{"skills":[]}',
 metadata: { count: 3 },
 },
 } satisfies SBChatMessagePart;

 render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [listSkillsPart] }]}
 />
 </TooltipProvider>
 );

 expect(screen.queryByText('Listed skills')).toBeTruthy();
 expect(screen.queryByText('3 skills')).toBeTruthy();
 });

 test('shows a non-pulsing waiting state for an approval-requested tool call', () => {
 const approvalRequestedPart = {
 type: 'tool-create_skill',
 toolCallId: 'tool-call-approval',
 state: 'approval-requested',
 input: {
 name: 'Review PR',
 slug: 'review-pr',
 description: 'Review a pull request.',
 instructions: 'Look for correctness issues first.',
 },
 approval: { id: 'approval-1' },
 } satisfies SBChatMessagePart;

 render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={true}
 isNetworkActive={false}
 isAwaitingToolApproval={true}
 thinkingSteps={[{ stepIndex: 0, parts: [approvalRequestedPart] }]}
 />
 </TooltipProvider>
 );

 expect(screen.queryByText('Waiting for approval')).toBeTruthy();
 expect(screen.queryByText('Creating skill...')).toBeNull();
 });

 test('shows a denied label for an output-denied tool call', () => {
 const deniedPart = {
 type: 'tool-create_skill',
 toolCallId: 'tool-call-denied',
 title: 'Create skill',
 state: 'output-denied',
 input: {
 name: 'Review PR',
 slug: 'review-pr',
 description: 'Review a pull request.',
 instructions: 'Look for correctness issues first.',
 },
 approval: { id: 'approval-1', approved: false, reason: 'User denied' },
 } satisfies SBChatMessagePart;

 render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [deniedPart] }]}
 />
 </TooltipProvider>
 );

 expect(screen.queryByText('Create skill denied')).toBeTruthy();
 expect(screen.queryByText('Creating skill...')).toBeNull();
 });

 test('renders an unavailable skill load instead of a silent no-op', () => {
 const unavailableSkillPart = {
 type: 'tool-load_skill',
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(web): add create_skill, update_skill, and list_skills tools to MCP and Ask Sourcebot#1612

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

jsourcebot
merged 4 commits into

from

Aug 20, 2026
 Merged


feat(web): add create_skill, update_skill, and list_skills tools to MCP and Ask Sourcebot
#1612
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


4 commits


Select commit
Hold shift + click to select a range
1c8368d

feat(web): add create_skill, update_skill, and list_skills tools to M…


jsourcebot Aug 20, 2026
aac1bb8

fix(web): reject repository-scoped access tokens in skill tools


jsourcebot Aug 20, 2026
6c0a779

docs: link skill tools changelog entry to PR


jsourcebot Aug 20, 2026
88c472f

docs: reword MCP skill tool sections in second person


jsourcebot Aug 20, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


1 change: 1 addition & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

### Added
- [EE] Added a `list_branches` tool to the MCP server and Ask Sourcebot for discovering repository branches and whether they are indexed. [#1609](https://github.com/sourcebot-dev/sourcebot/pull/1609)
- [EE] Added `create_skill`, `update_skill`, and `list_skills` tools to the MCP server and Ask Sourcebot for managing skills. [#1612](https://github.com/sourcebot-dev/sourcebot/pull/1612)

### Changed
- Migrated connection syncing, repository indexing, permission syncing, and background pruning from in-process managers and pollers to BullMQ workloads with retries and per-resource execution locking. [#1427](https://github.com/sourcebot-dev/sourcebot/pull/1427)
Expand Down

41 changes: 41 additions & 0 deletions
docs/docs/features/mcp-server.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -452,3 +452,44 @@ Parameters:
| `repos` | no | The repositories that are accessible to the agent during the chat. If not provided, all repositories are accessible. |
| `languageModel` | no | The language model to use for answering the question. Object with `provider` and `model`. If not provided, defaults to the first model in the config. Use `list_language_models` to see available options. |
| `visibility` | no | The visibility of the chat session (`'PRIVATE'` or `'PUBLIC'`). Defaults to `PRIVATE` for authenticated users and `PUBLIC` for anonymous users. Set to `PUBLIC` to make the chat viewable by anyone with the link (useful in shared environments like Slack). |

### `create_skill`

You can create an agent skill: a reusable set of instructions you invoke in Ask Sourcebot as a `/<slug>` slash command, or that the agent loads automatically when your request matches its description. The skill is personal to you and enabled immediately. The result includes a link to the skill in **Settings → Skills**.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:---------------|:---------|:------------|
| `name` | yes | Display name for the skill (1-80 characters). |
| `slug` | yes | Slash command for the skill, without the leading `/`. Lowercase letters, numbers, and hyphens; at most 64 characters. Must be unique among the user's skills. |
| `description` | yes | When to use the skill (1-500 characters). Used by the agent to auto-load the skill. |
| `instructions` | yes | Markdown instructions the agent follows when the skill is invoked (1-20,000 characters). |

### `update_skill`

You can edit an existing skill in place. Fields you omit keep their current values. You can edit your personal skills, and shared skills only if you created them and they are enabled. Skills synced from a repository file are rejected; edit those in **Settings → Skills**. This tool never enables or disables a skill, and never moves it between the personal and shared catalogs.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:---------------|:---------|:------------|
| `slug` | yes | Current slash command of the skill to update, without the leading `/`. |
| `scope` | yes | Which catalog the skill lives in: `personal` or `shared`. |
| `name` | no | New display name (1-80 characters). |
| `newSlug` | no | New slash command, without the leading `/`. Lowercase letters, numbers, and hyphens; at most 64 characters. |
| `description` | no | New description of when to use the skill (1-500 characters). |
| `instructions` | no | New markdown instructions (1-20,000 characters). |

### `list_skills`

You can list the skills visible to you: your personal skills plus your organization's shared catalog. Each row includes `slug` and `scope` (the pair `update_skill` needs), `enabled`, `isSynced` (linked to a repository file), `canEdit` (whether `update_skill` can edit it), and, on shared rows, `adopted`. Skill instructions are never included.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:--------|:---------|:------------|
| `scope` | no | Filter to one catalog: `personal` or `shared`. Omit to list both. |

10 changes: 8 additions & 2 deletions
packages/web/src/app/api/(server)/ee/mcp/route.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -75,7 +75,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
 }

 const response = await sew(() =>
 withOptionalAuth(async ({ user }) => {
 withOptionalAuth(async ({ user, principal }) => {
 if (env.EXPERIMENT_ASK_GH_ENABLED === 'true' && !user) {
 return notAuthenticated();
 }
Expand DownExpand Up@@ -111,7 +111,13 @@ export const POST = apiHandler(async (request: NextRequest) => {
 },
 });

 const mcpServer = await createMcpServer();
 // Repository-scoped access tokens never get the skill management
 // tools: their documented authorization boundary is the selected
 // repositories only. The tools also reject scoped principals
 // per-request, since a session is keyed by owner, not principal.
 const mcpServer = await createMcpServer({
 canManageSkills: ownerId !== null && principal?.source !== 'scoped_access_token',
 });
 await mcpServer.connect(transport);

 return transport.handleRequest(request);
Expand Down

26 changes: 26 additions & 0 deletions
packages/web/src/ee/features/chat/agent.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -89,6 +89,9 @@ vi.mock('@/features/tools', () => {
 listReposDefinition: createToolDefinition('list_repos'),
 listTreeDefinition: createToolDefinition('list_tree'),
 readFileDefinition: createToolDefinition('read_file'),
 createSkillDefinition: createToolDefinition('create_skill'),
 updateSkillDefinition: createToolDefinition('update_skill'),
 listSkillsDefinition: createToolDefinition('list_skills'),
 toVercelAITool: vi.fn((definition: { name: string }) => ({
 name: definition.name,
 })),
Expand DownExpand Up@@ -273,6 +276,29 @@ describe('createMessageStream built-in tools', () => {
 expect(tools).toHaveProperty('list_branches');
 expect(activeTools).toContain('list_branches');
 });

 test('makes the skill management tools available to authenticated, interactive requesters', async () => {
 const { tools, activeTools } = await runCreateMessageStream([createUserMessage()], {
 userId: 'user-1',
 orgId: 1,
 });

 for (const toolName of ['create_skill', 'update_skill', 'list_skills']) {
 expect(tools).toHaveProperty(toolName);
 expect(activeTools).toContain(toolName);
 }
 });

 test('omits the skill management tools when the requester is anonymous or programmatic', async () => {
 const { tools, activeTools } = await runCreateMessageStream([createUserMessage()]);

 for (const toolName of ['create_skill', 'update_skill', 'list_skills']) {
 expect(tools).not.toHaveProperty(toolName);
 expect(activeTools).not.toContain(toolName);
 }
 // The other built-ins are unaffected by the gate.
 expect(tools).toHaveProperty('list_branches');
 });
});

describe('createMessageStream approval continuation', () => {
Expand Down

18 changes: 17 additions & 1 deletion
packages/web/src/ee/features/chat/agent.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -24,6 +24,7 @@ import { ANSWER_TAG, FILE_REFERENCE_PREFIX } from "@/features/chat/constants";
import { Source } from "@/features/chat/types";
import { addLineNumbers, fileReferenceToString, formatAttachmentsForPrompt, getAnswerPartFromAssistantMessage, getTurnProgressState, getUserMessageAttachments, getUserMessageText } from "@/features/chat/utils";
import { createTools } from "./tools";
import { createSkillDefinition, listSkillsDefinition, updateSkillDefinition } from "@/features/tools";
import { getConnectedMcpClients } from "@/ee/features/chat/mcp/mcpClientFactory";
import { getMcpTools, McpToolsResult } from "@/ee/features/chat/mcp/mcpToolSets";
import {
Expand DownExpand Up@@ -692,7 +693,22 @@ const createAgentStream = async ({
 skillRegistry,
 });

 const builtinTools = createTools({ source: 'sourcebot-ask-agent', selectedRepos: sortedRepos });
 const allBuiltinTools = createTools({ source: 'sourcebot-ask-agent', selectedRepos: sortedRepos });

 // The skill management tools require an interactive, authenticated
 // requester: same gate as load_skill. This also excludes programmatic runs
 // (askCodebase, /api/chat/blocking) where nobody can answer an approval
 // request.
 const skillManagementToolNames: string[] = [
 createSkillDefinition.name,
 updateSkillDefinition.name,
 listSkillsDefinition.name,
 ];
 const builtinTools: Record<string, Tool> = (userId !== undefined && orgId !== undefined)
 ? allBuiltinTools
 : Object.fromEntries(
 Object.entries(allBuiltinTools).filter(([name]) => !skillManagementToolNames.includes(name)),
 );
 const builtinToolNames = Object.keys(builtinTools);
 const allTools: Record<string, Tool> = {
 ...builtinTools,
Expand Down

11 changes: 11 additions & 0 deletions
packages/web/src/ee/features/chat/askCommandsContext.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
'use client';

import { createContext, useContext } from 'react';
import type { AskCommandDefinition } from '@/features/chat/commands/types';

// The chat page's server-rendered slash-command catalog, made available to
// nested chat components (e.g. the tool approval banner resolves a skill's
// display name from its slug + scope).
export const AskCommandsContext = createContext<AskCommandDefinition[]>([]);

export const useAskCommands = () => useContext(AskCommandsContext);

3 changes: 3 additions & 0 deletions
packages/web/src/ee/features/chat/components/chatThread/chatThread.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -33,6 +33,7 @@ import { McpReconnectContext } from '../../mcpReconnectContext';
import { McpAuthRequiredData, McpServerLoadFailureData, useMcpReconnectController } from './useMcpReconnectController';
import { McpReconnectBanner } from './mcpReconnectBanner';
import { ToolApprovalProvider } from '../../toolApprovalContext';
import { AskCommandsContext } from '../../askCommandsContext';
import useCaptureEvent from '@/hooks/useCaptureEvent';
import { SignInPromptBanner } from './signInPromptBanner';
import { DuplicateChatDialog } from '@/app/(app)/chat/components/duplicateChatDialog';
Expand DownExpand Up@@ -459,6 +460,7 @@ export const ChatThread = ({

 return (
 <ToolApprovalProvider value={addToolApprovalResponse}>
 <AskCommandsContext.Provider value={askCommands}>
 <McpReconnectContext.Provider value={mcpReconnectContextValue}>
 <McpServerIconContext.Provider value={mcpServerIconMap}>
 <McpToolNameContext.Provider value={mcpToolNameMap}>
Expand DownExpand Up@@ -615,6 +617,7 @@ export const ChatThread = ({
 </McpToolNameContext.Provider>
 </McpServerIconContext.Provider>
 </McpReconnectContext.Provider>
 </AskCommandsContext.Provider>
 </ToolApprovalProvider>
 );
}

184 changes: 184 additions & 0 deletions
packages/web/src/ee/features/chat/components/chatThread/detailsCard.test.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -194,6 +194,190 @@ describe('DetailsCard', () => {
 expect(screen.queryByText('Look for correctness issues first.')).toBeNull();
 });

 test('renders a create_skill success summary with the name and command', () => {
 const createSkillPart = {
 type: 'tool-create_skill',
 toolCallId: 'tool-call-create-skill',
 state: 'output-available',
 input: {
 name: 'Review PR',
 slug: 'review-pr',
 description: 'Review a pull request.',
 instructions: 'Look for correctness issues first.',
 },
 output: {
 output: '{}',
 metadata: {
 id: 'skill-1',
 slug: 'review-pr',
 name: 'Review PR',
 url: 'https://sourcebot.example.com/settings/skills?skill=skill-1',
 },
 },
 } satisfies SBChatMessagePart;

 const { container } = render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [createSkillPart] }]}
 />
 </TooltipProvider>
 );

 expect(container.textContent).toContain('Created skill');
 expect(container.textContent).toContain('Review PR');
 expect(container.textContent).toContain('/review-pr');
 expect(screen.queryByText('Creating skill...')).toBeNull();
 });

 test('renders an update_skill success summary with the name and command', () => {
 const updateSkillPart = {
 type: 'tool-update_skill',
 toolCallId: 'tool-call-update-skill',
 state: 'output-available',
 input: {
 slug: 'review-pr',
 scope: 'shared',
 name: 'Review PR v2',
 },
 output: {
 output: '{}',
 metadata: {
 id: 'skill-1',
 slug: 'review-pr',
 name: 'Review PR v2',
 scope: 'shared',
 url: 'https://sourcebot.example.com/settings/skills?skill=skill-1',
 },
 },
 } satisfies SBChatMessagePart;

 const { container } = render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [updateSkillPart] }]}
 />
 </TooltipProvider>
 );

 expect(container.textContent).toContain('Updated shared skill');
 expect(container.textContent).toContain('Review PR v2');
 expect(container.textContent).toContain('/review-pr');
 expect(screen.queryByText('Updating skill...')).toBeNull();
 });

 test('renders a list_skills count summary', () => {
 const listSkillsPart = {
 type: 'tool-list_skills',
 toolCallId: 'tool-call-list-skills',
 state: 'output-available',
 input: {},
 output: {
 output: '{"skills":[]}',
 metadata: { count: 3 },
 },
 } satisfies SBChatMessagePart;

 render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [listSkillsPart] }]}
 />
 </TooltipProvider>
 );

 expect(screen.queryByText('Listed skills')).toBeTruthy();
 expect(screen.queryByText('3 skills')).toBeTruthy();
 });

 test('shows a non-pulsing waiting state for an approval-requested tool call', () => {
 const approvalRequestedPart = {
 type: 'tool-create_skill',
 toolCallId: 'tool-call-approval',
 state: 'approval-requested',
 input: {
 name: 'Review PR',
 slug: 'review-pr',
 description: 'Review a pull request.',
 instructions: 'Look for correctness issues first.',
 },
 approval: { id: 'approval-1' },
 } satisfies SBChatMessagePart;

 render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={true}
 isNetworkActive={false}
 isAwaitingToolApproval={true}
 thinkingSteps={[{ stepIndex: 0, parts: [approvalRequestedPart] }]}
 />
 </TooltipProvider>
 );

 expect(screen.queryByText('Waiting for approval')).toBeTruthy();
 expect(screen.queryByText('Creating skill...')).toBeNull();
 });

 test('shows a denied label for an output-denied tool call', () => {
 const deniedPart = {
 type: 'tool-create_skill',
 toolCallId: 'tool-call-denied',
 title: 'Create skill',
 state: 'output-denied',
 input: {
 name: 'Review PR',
 slug: 'review-pr',
 description: 'Review a pull request.',
 instructions: 'Look for correctness issues first.',
 },
 approval: { id: 'approval-1', approved: false, reason: 'User denied' },
 } satisfies SBChatMessagePart;

 render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [deniedPart] }]}
 />
 </TooltipProvider>
 );

 expect(screen.queryByText('Create skill denied')).toBeTruthy();
 expect(screen.queryByText('Creating skill...')).toBeNull();
 });

 test('renders an unavailable skill load instead of a silent no-op', () => {
 const unavailableSkillPart = {
 type: 'tool-load_skill',
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
feat(web): add create_skill, update_skill, and list_skills tools to MCP and Ask Sourcebot#1612

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

jsourcebot
merged 4 commits into

from

Aug 20, 2026
 Merged


feat(web): add create_skill, update_skill, and list_skills tools to MCP and Ask Sourcebot
#1612
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


4 commits


Select commit
Hold shift + click to select a range
1c8368d

feat(web): add create_skill, update_skill, and list_skills tools to M…


jsourcebot Aug 20, 2026
aac1bb8

fix(web): reject repository-scoped access tokens in skill tools


jsourcebot Aug 20, 2026
6c0a779

docs: link skill tools changelog entry to PR


jsourcebot Aug 20, 2026
88c472f

docs: reword MCP skill tool sections in second person


jsourcebot Aug 20, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


1 change: 1 addition & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

### Added
- [EE] Added a `list_branches` tool to the MCP server and Ask Sourcebot for discovering repository branches and whether they are indexed. [#1609](https://github.com/sourcebot-dev/sourcebot/pull/1609)
- [EE] Added `create_skill`, `update_skill`, and `list_skills` tools to the MCP server and Ask Sourcebot for managing skills. [#1612](https://github.com/sourcebot-dev/sourcebot/pull/1612)

### Changed
- Migrated connection syncing, repository indexing, permission syncing, and background pruning from in-process managers and pollers to BullMQ workloads with retries and per-resource execution locking. [#1427](https://github.com/sourcebot-dev/sourcebot/pull/1427)
Expand Down

41 changes: 41 additions & 0 deletions
docs/docs/features/mcp-server.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -452,3 +452,44 @@ Parameters:
| `repos` | no | The repositories that are accessible to the agent during the chat. If not provided, all repositories are accessible. |
| `languageModel` | no | The language model to use for answering the question. Object with `provider` and `model`. If not provided, defaults to the first model in the config. Use `list_language_models` to see available options. |
| `visibility` | no | The visibility of the chat session (`'PRIVATE'` or `'PUBLIC'`). Defaults to `PRIVATE` for authenticated users and `PUBLIC` for anonymous users. Set to `PUBLIC` to make the chat viewable by anyone with the link (useful in shared environments like Slack). |

### `create_skill`

You can create an agent skill: a reusable set of instructions you invoke in Ask Sourcebot as a `/<slug>` slash command, or that the agent loads automatically when your request matches its description. The skill is personal to you and enabled immediately. The result includes a link to the skill in **Settings → Skills**.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:---------------|:---------|:------------|
| `name` | yes | Display name for the skill (1-80 characters). |
| `slug` | yes | Slash command for the skill, without the leading `/`. Lowercase letters, numbers, and hyphens; at most 64 characters. Must be unique among the user's skills. |
| `description` | yes | When to use the skill (1-500 characters). Used by the agent to auto-load the skill. |
| `instructions` | yes | Markdown instructions the agent follows when the skill is invoked (1-20,000 characters). |

### `update_skill`

You can edit an existing skill in place. Fields you omit keep their current values. You can edit your personal skills, and shared skills only if you created them and they are enabled. Skills synced from a repository file are rejected; edit those in **Settings → Skills**. This tool never enables or disables a skill, and never moves it between the personal and shared catalogs.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:---------------|:---------|:------------|
| `slug` | yes | Current slash command of the skill to update, without the leading `/`. |
| `scope` | yes | Which catalog the skill lives in: `personal` or `shared`. |
| `name` | no | New display name (1-80 characters). |
| `newSlug` | no | New slash command, without the leading `/`. Lowercase letters, numbers, and hyphens; at most 64 characters. |
| `description` | no | New description of when to use the skill (1-500 characters). |
| `instructions` | no | New markdown instructions (1-20,000 characters). |

### `list_skills`

You can list the skills visible to you: your personal skills plus your organization's shared catalog. Each row includes `slug` and `scope` (the pair `update_skill` needs), `enabled`, `isSynced` (linked to a repository file), `canEdit` (whether `update_skill` can edit it), and, on shared rows, `adopted`. Skill instructions are never included.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:--------|:---------|:------------|
| `scope` | no | Filter to one catalog: `personal` or `shared`. Omit to list both. |

10 changes: 8 additions & 2 deletions
packages/web/src/app/api/(server)/ee/mcp/route.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -75,7 +75,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
 }

 const response = await sew(() =>
 withOptionalAuth(async ({ user }) => {
 withOptionalAuth(async ({ user, principal }) => {
 if (env.EXPERIMENT_ASK_GH_ENABLED === 'true' && !user) {
 return notAuthenticated();
 }
Expand DownExpand Up@@ -111,7 +111,13 @@ export const POST = apiHandler(async (request: NextRequest) => {
 },
 });

 const mcpServer = await createMcpServer();
 // Repository-scoped access tokens never get the skill management
 // tools: their documented authorization boundary is the selected
 // repositories only. The tools also reject scoped principals
 // per-request, since a session is keyed by owner, not principal.
 const mcpServer = await createMcpServer({
 canManageSkills: ownerId !== null && principal?.source !== 'scoped_access_token',
 });
 await mcpServer.connect(transport);

 return transport.handleRequest(request);
Expand Down

26 changes: 26 additions & 0 deletions
packages/web/src/ee/features/chat/agent.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -89,6 +89,9 @@ vi.mock('@/features/tools', () => {
 listReposDefinition: createToolDefinition('list_repos'),
 listTreeDefinition: createToolDefinition('list_tree'),
 readFileDefinition: createToolDefinition('read_file'),
 createSkillDefinition: createToolDefinition('create_skill'),
 updateSkillDefinition: createToolDefinition('update_skill'),
 listSkillsDefinition: createToolDefinition('list_skills'),
 toVercelAITool: vi.fn((definition: { name: string }) => ({
 name: definition.name,
 })),
Expand DownExpand Up@@ -273,6 +276,29 @@ describe('createMessageStream built-in tools', () => {
 expect(tools).toHaveProperty('list_branches');
 expect(activeTools).toContain('list_branches');
 });

 test('makes the skill management tools available to authenticated, interactive requesters', async () => {
 const { tools, activeTools } = await runCreateMessageStream([createUserMessage()], {
 userId: 'user-1',
 orgId: 1,
 });

 for (const toolName of ['create_skill', 'update_skill', 'list_skills']) {
 expect(tools).toHaveProperty(toolName);
 expect(activeTools).toContain(toolName);
 }
 });

 test('omits the skill management tools when the requester is anonymous or programmatic', async () => {
 const { tools, activeTools } = await runCreateMessageStream([createUserMessage()]);

 for (const toolName of ['create_skill', 'update_skill', 'list_skills']) {
 expect(tools).not.toHaveProperty(toolName);
 expect(activeTools).not.toContain(toolName);
 }
 // The other built-ins are unaffected by the gate.
 expect(tools).toHaveProperty('list_branches');
 });
});

describe('createMessageStream approval continuation', () => {
Expand Down

18 changes: 17 additions & 1 deletion
packages/web/src/ee/features/chat/agent.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -24,6 +24,7 @@ import { ANSWER_TAG, FILE_REFERENCE_PREFIX } from "@/features/chat/constants";
import { Source } from "@/features/chat/types";
import { addLineNumbers, fileReferenceToString, formatAttachmentsForPrompt, getAnswerPartFromAssistantMessage, getTurnProgressState, getUserMessageAttachments, getUserMessageText } from "@/features/chat/utils";
import { createTools } from "./tools";
import { createSkillDefinition, listSkillsDefinition, updateSkillDefinition } from "@/features/tools";
import { getConnectedMcpClients } from "@/ee/features/chat/mcp/mcpClientFactory";
import { getMcpTools, McpToolsResult } from "@/ee/features/chat/mcp/mcpToolSets";
import {
Expand DownExpand Up@@ -692,7 +693,22 @@ const createAgentStream = async ({
 skillRegistry,
 });

 const builtinTools = createTools({ source: 'sourcebot-ask-agent', selectedRepos: sortedRepos });
 const allBuiltinTools = createTools({ source: 'sourcebot-ask-agent', selectedRepos: sortedRepos });

 // The skill management tools require an interactive, authenticated
 // requester: same gate as load_skill. This also excludes programmatic runs
 // (askCodebase, /api/chat/blocking) where nobody can answer an approval
 // request.
 const skillManagementToolNames: string[] = [
 createSkillDefinition.name,
 updateSkillDefinition.name,
 listSkillsDefinition.name,
 ];
 const builtinTools: Record<string, Tool> = (userId !== undefined && orgId !== undefined)
 ? allBuiltinTools
 : Object.fromEntries(
 Object.entries(allBuiltinTools).filter(([name]) => !skillManagementToolNames.includes(name)),
 );
 const builtinToolNames = Object.keys(builtinTools);
 const allTools: Record<string, Tool> = {
 ...builtinTools,
Expand Down

11 changes: 11 additions & 0 deletions
packages/web/src/ee/features/chat/askCommandsContext.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
'use client';

import { createContext, useContext } from 'react';
import type { AskCommandDefinition } from '@/features/chat/commands/types';

// The chat page's server-rendered slash-command catalog, made available to
// nested chat components (e.g. the tool approval banner resolves a skill's
// display name from its slug + scope).
export const AskCommandsContext = createContext<AskCommandDefinition[]>([]);

export const useAskCommands = () => useContext(AskCommandsContext);

3 changes: 3 additions & 0 deletions
packages/web/src/ee/features/chat/components/chatThread/chatThread.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -33,6 +33,7 @@ import { McpReconnectContext } from '../../mcpReconnectContext';
import { McpAuthRequiredData, McpServerLoadFailureData, useMcpReconnectController } from './useMcpReconnectController';
import { McpReconnectBanner } from './mcpReconnectBanner';
import { ToolApprovalProvider } from '../../toolApprovalContext';
import { AskCommandsContext } from '../../askCommandsContext';
import useCaptureEvent from '@/hooks/useCaptureEvent';
import { SignInPromptBanner } from './signInPromptBanner';
import { DuplicateChatDialog } from '@/app/(app)/chat/components/duplicateChatDialog';
Expand DownExpand Up@@ -459,6 +460,7 @@ export const ChatThread = ({

 return (
 <ToolApprovalProvider value={addToolApprovalResponse}>
 <AskCommandsContext.Provider value={askCommands}>
 <McpReconnectContext.Provider value={mcpReconnectContextValue}>
 <McpServerIconContext.Provider value={mcpServerIconMap}>
 <McpToolNameContext.Provider value={mcpToolNameMap}>
Expand DownExpand Up@@ -615,6 +617,7 @@ export const ChatThread = ({
 </McpToolNameContext.Provider>
 </McpServerIconContext.Provider>
 </McpReconnectContext.Provider>
 </AskCommandsContext.Provider>
 </ToolApprovalProvider>
 );
}

184 changes: 184 additions & 0 deletions
packages/web/src/ee/features/chat/components/chatThread/detailsCard.test.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -194,6 +194,190 @@ describe('DetailsCard', () => {
 expect(screen.queryByText('Look for correctness issues first.')).toBeNull();
 });

 test('renders a create_skill success summary with the name and command', () => {
 const createSkillPart = {
 type: 'tool-create_skill',
 toolCallId: 'tool-call-create-skill',
 state: 'output-available',
 input: {
 name: 'Review PR',
 slug: 'review-pr',
 description: 'Review a pull request.',
 instructions: 'Look for correctness issues first.',
 },
 output: {
 output: '{}',
 metadata: {
 id: 'skill-1',
 slug: 'review-pr',
 name: 'Review PR',
 url: 'https://sourcebot.example.com/settings/skills?skill=skill-1',
 },
 },
 } satisfies SBChatMessagePart;

 const { container } = render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [createSkillPart] }]}
 />
 </TooltipProvider>
 );

 expect(container.textContent).toContain('Created skill');
 expect(container.textContent).toContain('Review PR');
 expect(container.textContent).toContain('/review-pr');
 expect(screen.queryByText('Creating skill...')).toBeNull();
 });

 test('renders an update_skill success summary with the name and command', () => {
 const updateSkillPart = {
 type: 'tool-update_skill',
 toolCallId: 'tool-call-update-skill',
 state: 'output-available',
 input: {
 slug: 'review-pr',
 scope: 'shared',
 name: 'Review PR v2',
 },
 output: {
 output: '{}',
 metadata: {
 id: 'skill-1',
 slug: 'review-pr',
 name: 'Review PR v2',
 scope: 'shared',
 url: 'https://sourcebot.example.com/settings/skills?skill=skill-1',
 },
 },
 } satisfies SBChatMessagePart;

 const { container } = render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [updateSkillPart] }]}
 />
 </TooltipProvider>
 );

 expect(container.textContent).toContain('Updated shared skill');
 expect(container.textContent).toContain('Review PR v2');
 expect(container.textContent).toContain('/review-pr');
 expect(screen.queryByText('Updating skill...')).toBeNull();
 });

 test('renders a list_skills count summary', () => {
 const listSkillsPart = {
 type: 'tool-list_skills',
 toolCallId: 'tool-call-list-skills',
 state: 'output-available',
 input: {},
 output: {
 output: '{"skills":[]}',
 metadata: { count: 3 },
 },
 } satisfies SBChatMessagePart;

 render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [listSkillsPart] }]}
 />
 </TooltipProvider>
 );

 expect(screen.queryByText('Listed skills')).toBeTruthy();
 expect(screen.queryByText('3 skills')).toBeTruthy();
 });

 test('shows a non-pulsing waiting state for an approval-requested tool call', () => {
 const approvalRequestedPart = {
 type: 'tool-create_skill',
 toolCallId: 'tool-call-approval',
 state: 'approval-requested',
 input: {
 name: 'Review PR',
 slug: 'review-pr',
 description: 'Review a pull request.',
 instructions: 'Look for correctness issues first.',
 },
 approval: { id: 'approval-1' },
 } satisfies SBChatMessagePart;

 render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={true}
 isNetworkActive={false}
 isAwaitingToolApproval={true}
 thinkingSteps={[{ stepIndex: 0, parts: [approvalRequestedPart] }]}
 />
 </TooltipProvider>
 );

 expect(screen.queryByText('Waiting for approval')).toBeTruthy();
 expect(screen.queryByText('Creating skill...')).toBeNull();
 });

 test('shows a denied label for an output-denied tool call', () => {
 const deniedPart = {
 type: 'tool-create_skill',
 toolCallId: 'tool-call-denied',
 title: 'Create skill',
 state: 'output-denied',
 input: {
 name: 'Review PR',
 slug: 'review-pr',
 description: 'Review a pull request.',
 instructions: 'Look for correctness issues first.',
 },
 approval: { id: 'approval-1', approved: false, reason: 'User denied' },
 } satisfies SBChatMessagePart;

 render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [deniedPart] }]}
 />
 </TooltipProvider>
 );

 expect(screen.queryByText('Create skill denied')).toBeTruthy();
 expect(screen.queryByText('Creating skill...')).toBeNull();
 });

 test('renders an unavailable skill load instead of a silent no-op', () => {
 const unavailableSkillPart = {
 type: 'tool-load_skill',
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(web): add create_skill, update_skill, and list_skills tools to MCP and Ask Sourcebot#1612

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

jsourcebot
merged 4 commits into

from

Aug 20, 2026
 Merged


feat(web): add create_skill, update_skill, and list_skills tools to MCP and Ask Sourcebot
#1612
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


4 commits


Select commit
Hold shift + click to select a range
1c8368d

feat(web): add create_skill, update_skill, and list_skills tools to M…


jsourcebot Aug 20, 2026
aac1bb8

fix(web): reject repository-scoped access tokens in skill tools


jsourcebot Aug 20, 2026
6c0a779

docs: link skill tools changelog entry to PR


jsourcebot Aug 20, 2026
88c472f

docs: reword MCP skill tool sections in second person


jsourcebot Aug 20, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


1 change: 1 addition & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

### Added
- [EE] Added a `list_branches` tool to the MCP server and Ask Sourcebot for discovering repository branches and whether they are indexed. [#1609](https://github.com/sourcebot-dev/sourcebot/pull/1609)
- [EE] Added `create_skill`, `update_skill`, and `list_skills` tools to the MCP server and Ask Sourcebot for managing skills. [#1612](https://github.com/sourcebot-dev/sourcebot/pull/1612)

### Changed
- Migrated connection syncing, repository indexing, permission syncing, and background pruning from in-process managers and pollers to BullMQ workloads with retries and per-resource execution locking. [#1427](https://github.com/sourcebot-dev/sourcebot/pull/1427)
Expand Down

41 changes: 41 additions & 0 deletions
docs/docs/features/mcp-server.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -452,3 +452,44 @@ Parameters:
| `repos` | no | The repositories that are accessible to the agent during the chat. If not provided, all repositories are accessible. |
| `languageModel` | no | The language model to use for answering the question. Object with `provider` and `model`. If not provided, defaults to the first model in the config. Use `list_language_models` to see available options. |
| `visibility` | no | The visibility of the chat session (`'PRIVATE'` or `'PUBLIC'`). Defaults to `PRIVATE` for authenticated users and `PUBLIC` for anonymous users. Set to `PUBLIC` to make the chat viewable by anyone with the link (useful in shared environments like Slack). |

### `create_skill`

You can create an agent skill: a reusable set of instructions you invoke in Ask Sourcebot as a `/<slug>` slash command, or that the agent loads automatically when your request matches its description. The skill is personal to you and enabled immediately. The result includes a link to the skill in **Settings → Skills**.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:---------------|:---------|:------------|
| `name` | yes | Display name for the skill (1-80 characters). |
| `slug` | yes | Slash command for the skill, without the leading `/`. Lowercase letters, numbers, and hyphens; at most 64 characters. Must be unique among the user's skills. |
| `description` | yes | When to use the skill (1-500 characters). Used by the agent to auto-load the skill. |
| `instructions` | yes | Markdown instructions the agent follows when the skill is invoked (1-20,000 characters). |

### `update_skill`

You can edit an existing skill in place. Fields you omit keep their current values. You can edit your personal skills, and shared skills only if you created them and they are enabled. Skills synced from a repository file are rejected; edit those in **Settings → Skills**. This tool never enables or disables a skill, and never moves it between the personal and shared catalogs.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:---------------|:---------|:------------|
| `slug` | yes | Current slash command of the skill to update, without the leading `/`. |
| `scope` | yes | Which catalog the skill lives in: `personal` or `shared`. |
| `name` | no | New display name (1-80 characters). |
| `newSlug` | no | New slash command, without the leading `/`. Lowercase letters, numbers, and hyphens; at most 64 characters. |
| `description` | no | New description of when to use the skill (1-500 characters). |
| `instructions` | no | New markdown instructions (1-20,000 characters). |

### `list_skills`

You can list the skills visible to you: your personal skills plus your organization's shared catalog. Each row includes `slug` and `scope` (the pair `update_skill` needs), `enabled`, `isSynced` (linked to a repository file), `canEdit` (whether `update_skill` can edit it), and, on shared rows, `adopted`. Skill instructions are never included.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:--------|:---------|:------------|
| `scope` | no | Filter to one catalog: `personal` or `shared`. Omit to list both. |

10 changes: 8 additions & 2 deletions
packages/web/src/app/api/(server)/ee/mcp/route.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -75,7 +75,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
 }

 const response = await sew(() =>
 withOptionalAuth(async ({ user }) => {
 withOptionalAuth(async ({ user, principal }) => {
 if (env.EXPERIMENT_ASK_GH_ENABLED === 'true' && !user) {
 return notAuthenticated();
 }
Expand DownExpand Up@@ -111,7 +111,13 @@ export const POST = apiHandler(async (request: NextRequest) => {
 },
 });

 const mcpServer = await createMcpServer();
 // Repository-scoped access tokens never get the skill management
 // tools: their documented authorization boundary is the selected
 // repositories only. The tools also reject scoped principals
 // per-request, since a session is keyed by owner, not principal.
 const mcpServer = await createMcpServer({
 canManageSkills: ownerId !== null && principal?.source !== 'scoped_access_token',
 });
 await mcpServer.connect(transport);

 return transport.handleRequest(request);
Expand Down

26 changes: 26 additions & 0 deletions
packages/web/src/ee/features/chat/agent.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -89,6 +89,9 @@ vi.mock('@/features/tools', () => {
 listReposDefinition: createToolDefinition('list_repos'),
 listTreeDefinition: createToolDefinition('list_tree'),
 readFileDefinition: createToolDefinition('read_file'),
 createSkillDefinition: createToolDefinition('create_skill'),
 updateSkillDefinition: createToolDefinition('update_skill'),
 listSkillsDefinition: createToolDefinition('list_skills'),
 toVercelAITool: vi.fn((definition: { name: string }) => ({
 name: definition.name,
 })),
Expand DownExpand Up@@ -273,6 +276,29 @@ describe('createMessageStream built-in tools', () => {
 expect(tools).toHaveProperty('list_branches');
 expect(activeTools).toContain('list_branches');
 });

 test('makes the skill management tools available to authenticated, interactive requesters', async () => {
 const { tools, activeTools } = await runCreateMessageStream([createUserMessage()], {
 userId: 'user-1',
 orgId: 1,
 });

 for (const toolName of ['create_skill', 'update_skill', 'list_skills']) {
 expect(tools).toHaveProperty(toolName);
 expect(activeTools).toContain(toolName);
 }
 });

 test('omits the skill management tools when the requester is anonymous or programmatic', async () => {
 const { tools, activeTools } = await runCreateMessageStream([createUserMessage()]);

 for (const toolName of ['create_skill', 'update_skill', 'list_skills']) {
 expect(tools).not.toHaveProperty(toolName);
 expect(activeTools).not.toContain(toolName);
 }
 // The other built-ins are unaffected by the gate.
 expect(tools).toHaveProperty('list_branches');
 });
});

describe('createMessageStream approval continuation', () => {
Expand Down

18 changes: 17 additions & 1 deletion
packages/web/src/ee/features/chat/agent.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -24,6 +24,7 @@ import { ANSWER_TAG, FILE_REFERENCE_PREFIX } from "@/features/chat/constants";
import { Source } from "@/features/chat/types";
import { addLineNumbers, fileReferenceToString, formatAttachmentsForPrompt, getAnswerPartFromAssistantMessage, getTurnProgressState, getUserMessageAttachments, getUserMessageText } from "@/features/chat/utils";
import { createTools } from "./tools";
import { createSkillDefinition, listSkillsDefinition, updateSkillDefinition } from "@/features/tools";
import { getConnectedMcpClients } from "@/ee/features/chat/mcp/mcpClientFactory";
import { getMcpTools, McpToolsResult } from "@/ee/features/chat/mcp/mcpToolSets";
import {
Expand DownExpand Up@@ -692,7 +693,22 @@ const createAgentStream = async ({
 skillRegistry,
 });

 const builtinTools = createTools({ source: 'sourcebot-ask-agent', selectedRepos: sortedRepos });
 const allBuiltinTools = createTools({ source: 'sourcebot-ask-agent', selectedRepos: sortedRepos });

 // The skill management tools require an interactive, authenticated
 // requester: same gate as load_skill. This also excludes programmatic runs
 // (askCodebase, /api/chat/blocking) where nobody can answer an approval
 // request.
 const skillManagementToolNames: string[] = [
 createSkillDefinition.name,
 updateSkillDefinition.name,
 listSkillsDefinition.name,
 ];
 const builtinTools: Record<string, Tool> = (userId !== undefined && orgId !== undefined)
 ? allBuiltinTools
 : Object.fromEntries(
 Object.entries(allBuiltinTools).filter(([name]) => !skillManagementToolNames.includes(name)),
 );
 const builtinToolNames = Object.keys(builtinTools);
 const allTools: Record<string, Tool> = {
 ...builtinTools,
Expand Down

11 changes: 11 additions & 0 deletions
packages/web/src/ee/features/chat/askCommandsContext.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
'use client';

import { createContext, useContext } from 'react';
import type { AskCommandDefinition } from '@/features/chat/commands/types';

// The chat page's server-rendered slash-command catalog, made available to
// nested chat components (e.g. the tool approval banner resolves a skill's
// display name from its slug + scope).
export const AskCommandsContext = createContext<AskCommandDefinition[]>([]);

export const useAskCommands = () => useContext(AskCommandsContext);

3 changes: 3 additions & 0 deletions
packages/web/src/ee/features/chat/components/chatThread/chatThread.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -33,6 +33,7 @@ import { McpReconnectContext } from '../../mcpReconnectContext';
import { McpAuthRequiredData, McpServerLoadFailureData, useMcpReconnectController } from './useMcpReconnectController';
import { McpReconnectBanner } from './mcpReconnectBanner';
import { ToolApprovalProvider } from '../../toolApprovalContext';
import { AskCommandsContext } from '../../askCommandsContext';
import useCaptureEvent from '@/hooks/useCaptureEvent';
import { SignInPromptBanner } from './signInPromptBanner';
import { DuplicateChatDialog } from '@/app/(app)/chat/components/duplicateChatDialog';
Expand DownExpand Up@@ -459,6 +460,7 @@ export const ChatThread = ({

 return (
 <ToolApprovalProvider value={addToolApprovalResponse}>
 <AskCommandsContext.Provider value={askCommands}>
 <McpReconnectContext.Provider value={mcpReconnectContextValue}>
 <McpServerIconContext.Provider value={mcpServerIconMap}>
 <McpToolNameContext.Provider value={mcpToolNameMap}>
Expand DownExpand Up@@ -615,6 +617,7 @@ export const ChatThread = ({
 </McpToolNameContext.Provider>
 </McpServerIconContext.Provider>
 </McpReconnectContext.Provider>
 </AskCommandsContext.Provider>
 </ToolApprovalProvider>
 );
}

184 changes: 184 additions & 0 deletions
packages/web/src/ee/features/chat/components/chatThread/detailsCard.test.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -194,6 +194,190 @@ describe('DetailsCard', () => {
 expect(screen.queryByText('Look for correctness issues first.')).toBeNull();
 });

 test('renders a create_skill success summary with the name and command', () => {
 const createSkillPart = {
 type: 'tool-create_skill',
 toolCallId: 'tool-call-create-skill',
 state: 'output-available',
 input: {
 name: 'Review PR',
 slug: 'review-pr',
 description: 'Review a pull request.',
 instructions: 'Look for correctness issues first.',
 },
 output: {
 output: '{}',
 metadata: {
 id: 'skill-1',
 slug: 'review-pr',
 name: 'Review PR',
 url: 'https://sourcebot.example.com/settings/skills?skill=skill-1',
 },
 },
 } satisfies SBChatMessagePart;

 const { container } = render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [createSkillPart] }]}
 />
 </TooltipProvider>
 );

 expect(container.textContent).toContain('Created skill');
 expect(container.textContent).toContain('Review PR');
 expect(container.textContent).toContain('/review-pr');
 expect(screen.queryByText('Creating skill...')).toBeNull();
 });

 test('renders an update_skill success summary with the name and command', () => {
 const updateSkillPart = {
 type: 'tool-update_skill',
 toolCallId: 'tool-call-update-skill',
 state: 'output-available',
 input: {
 slug: 'review-pr',
 scope: 'shared',
 name: 'Review PR v2',
 },
 output: {
 output: '{}',
 metadata: {
 id: 'skill-1',
 slug: 'review-pr',
 name: 'Review PR v2',
 scope: 'shared',
 url: 'https://sourcebot.example.com/settings/skills?skill=skill-1',
 },
 },
 } satisfies SBChatMessagePart;

 const { container } = render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [updateSkillPart] }]}
 />
 </TooltipProvider>
 );

 expect(container.textContent).toContain('Updated shared skill');
 expect(container.textContent).toContain('Review PR v2');
 expect(container.textContent).toContain('/review-pr');
 expect(screen.queryByText('Updating skill...')).toBeNull();
 });

 test('renders a list_skills count summary', () => {
 const listSkillsPart = {
 type: 'tool-list_skills',
 toolCallId: 'tool-call-list-skills',
 state: 'output-available',
 input: {},
 output: {
 output: '{"skills":[]}',
 metadata: { count: 3 },
 },
 } satisfies SBChatMessagePart;

 render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [listSkillsPart] }]}
 />
 </TooltipProvider>
 );

 expect(screen.queryByText('Listed skills')).toBeTruthy();
 expect(screen.queryByText('3 skills')).toBeTruthy();
 });

 test('shows a non-pulsing waiting state for an approval-requested tool call', () => {
 const approvalRequestedPart = {
 type: 'tool-create_skill',
 toolCallId: 'tool-call-approval',
 state: 'approval-requested',
 input: {
 name: 'Review PR',
 slug: 'review-pr',
 description: 'Review a pull request.',
 instructions: 'Look for correctness issues first.',
 },
 approval: { id: 'approval-1' },
 } satisfies SBChatMessagePart;

 render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={true}
 isNetworkActive={false}
 isAwaitingToolApproval={true}
 thinkingSteps={[{ stepIndex: 0, parts: [approvalRequestedPart] }]}
 />
 </TooltipProvider>
 );

 expect(screen.queryByText('Waiting for approval')).toBeTruthy();
 expect(screen.queryByText('Creating skill...')).toBeNull();
 });

 test('shows a denied label for an output-denied tool call', () => {
 const deniedPart = {
 type: 'tool-create_skill',
 toolCallId: 'tool-call-denied',
 title: 'Create skill',
 state: 'output-denied',
 input: {
 name: 'Review PR',
 slug: 'review-pr',
 description: 'Review a pull request.',
 instructions: 'Look for correctness issues first.',
 },
 approval: { id: 'approval-1', approved: false, reason: 'User denied' },
 } satisfies SBChatMessagePart;

 render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [deniedPart] }]}
 />
 </TooltipProvider>
 );

 expect(screen.queryByText('Create skill denied')).toBeTruthy();
 expect(screen.queryByText('Creating skill...')).toBeNull();
 });

 test('renders an unavailable skill load instead of a silent no-op', () => {
 const unavailableSkillPart = {
 type: 'tool-load_skill',
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(web): add create_skill, update_skill, and list_skills tools to MCP and Ask Sourcebot#1612

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

jsourcebot
merged 4 commits into

from

Aug 20, 2026
 Merged


feat(web): add create_skill, update_skill, and list_skills tools to MCP and Ask Sourcebot
#1612
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


4 commits


Select commit
Hold shift + click to select a range
1c8368d

feat(web): add create_skill, update_skill, and list_skills tools to M…


jsourcebot Aug 20, 2026
aac1bb8

fix(web): reject repository-scoped access tokens in skill tools


jsourcebot Aug 20, 2026
6c0a779

docs: link skill tools changelog entry to PR


jsourcebot Aug 20, 2026
88c472f

docs: reword MCP skill tool sections in second person


jsourcebot Aug 20, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


1 change: 1 addition & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

### Added
- [EE] Added a `list_branches` tool to the MCP server and Ask Sourcebot for discovering repository branches and whether they are indexed. [#1609](https://github.com/sourcebot-dev/sourcebot/pull/1609)
- [EE] Added `create_skill`, `update_skill`, and `list_skills` tools to the MCP server and Ask Sourcebot for managing skills. [#1612](https://github.com/sourcebot-dev/sourcebot/pull/1612)

### Changed
- Migrated connection syncing, repository indexing, permission syncing, and background pruning from in-process managers and pollers to BullMQ workloads with retries and per-resource execution locking. [#1427](https://github.com/sourcebot-dev/sourcebot/pull/1427)
Expand Down

41 changes: 41 additions & 0 deletions
docs/docs/features/mcp-server.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -452,3 +452,44 @@ Parameters:
| `repos` | no | The repositories that are accessible to the agent during the chat. If not provided, all repositories are accessible. |
| `languageModel` | no | The language model to use for answering the question. Object with `provider` and `model`. If not provided, defaults to the first model in the config. Use `list_language_models` to see available options. |
| `visibility` | no | The visibility of the chat session (`'PRIVATE'` or `'PUBLIC'`). Defaults to `PRIVATE` for authenticated users and `PUBLIC` for anonymous users. Set to `PUBLIC` to make the chat viewable by anyone with the link (useful in shared environments like Slack). |

### `create_skill`

You can create an agent skill: a reusable set of instructions you invoke in Ask Sourcebot as a `/<slug>` slash command, or that the agent loads automatically when your request matches its description. The skill is personal to you and enabled immediately. The result includes a link to the skill in **Settings → Skills**.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:---------------|:---------|:------------|
| `name` | yes | Display name for the skill (1-80 characters). |
| `slug` | yes | Slash command for the skill, without the leading `/`. Lowercase letters, numbers, and hyphens; at most 64 characters. Must be unique among the user's skills. |
| `description` | yes | When to use the skill (1-500 characters). Used by the agent to auto-load the skill. |
| `instructions` | yes | Markdown instructions the agent follows when the skill is invoked (1-20,000 characters). |

### `update_skill`

You can edit an existing skill in place. Fields you omit keep their current values. You can edit your personal skills, and shared skills only if you created them and they are enabled. Skills synced from a repository file are rejected; edit those in **Settings → Skills**. This tool never enables or disables a skill, and never moves it between the personal and shared catalogs.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:---------------|:---------|:------------|
| `slug` | yes | Current slash command of the skill to update, without the leading `/`. |
| `scope` | yes | Which catalog the skill lives in: `personal` or `shared`. |
| `name` | no | New display name (1-80 characters). |
| `newSlug` | no | New slash command, without the leading `/`. Lowercase letters, numbers, and hyphens; at most 64 characters. |
| `description` | no | New description of when to use the skill (1-500 characters). |
| `instructions` | no | New markdown instructions (1-20,000 characters). |

### `list_skills`

You can list the skills visible to you: your personal skills plus your organization's shared catalog. Each row includes `slug` and `scope` (the pair `update_skill` needs), `enabled`, `isSynced` (linked to a repository file), `canEdit` (whether `update_skill` can edit it), and, on shared rows, `adopted`. Skill instructions are never included.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:--------|:---------|:------------|
| `scope` | no | Filter to one catalog: `personal` or `shared`. Omit to list both. |

10 changes: 8 additions & 2 deletions
packages/web/src/app/api/(server)/ee/mcp/route.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -75,7 +75,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
 }

 const response = await sew(() =>
 withOptionalAuth(async ({ user }) => {
 withOptionalAuth(async ({ user, principal }) => {
 if (env.EXPERIMENT_ASK_GH_ENABLED === 'true' && !user) {
 return notAuthenticated();
 }
Expand DownExpand Up@@ -111,7 +111,13 @@ export const POST = apiHandler(async (request: NextRequest) => {
 },
 });

 const mcpServer = await createMcpServer();
 // Repository-scoped access tokens never get the skill management
 // tools: their documented authorization boundary is the selected
 // repositories only. The tools also reject scoped principals
 // per-request, since a session is keyed by owner, not principal.
 const mcpServer = await createMcpServer({
 canManageSkills: ownerId !== null && principal?.source !== 'scoped_access_token',
 });
 await mcpServer.connect(transport);

 return transport.handleRequest(request);
Expand Down

26 changes: 26 additions & 0 deletions
packages/web/src/ee/features/chat/agent.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -89,6 +89,9 @@ vi.mock('@/features/tools', () => {
 listReposDefinition: createToolDefinition('list_repos'),
 listTreeDefinition: createToolDefinition('list_tree'),
 readFileDefinition: createToolDefinition('read_file'),
 createSkillDefinition: createToolDefinition('create_skill'),
 updateSkillDefinition: createToolDefinition('update_skill'),
 listSkillsDefinition: createToolDefinition('list_skills'),
 toVercelAITool: vi.fn((definition: { name: string }) => ({
 name: definition.name,
 })),
Expand DownExpand Up@@ -273,6 +276,29 @@ describe('createMessageStream built-in tools', () => {
 expect(tools).toHaveProperty('list_branches');
 expect(activeTools).toContain('list_branches');
 });

 test('makes the skill management tools available to authenticated, interactive requesters', async () => {
 const { tools, activeTools } = await runCreateMessageStream([createUserMessage()], {
 userId: 'user-1',
 orgId: 1,
 });

 for (const toolName of ['create_skill', 'update_skill', 'list_skills']) {
 expect(tools).toHaveProperty(toolName);
 expect(activeTools).toContain(toolName);
 }
 });

 test('omits the skill management tools when the requester is anonymous or programmatic', async () => {
 const { tools, activeTools } = await runCreateMessageStream([createUserMessage()]);

 for (const toolName of ['create_skill', 'update_skill', 'list_skills']) {
 expect(tools).not.toHaveProperty(toolName);
 expect(activeTools).not.toContain(toolName);
 }
 // The other built-ins are unaffected by the gate.
 expect(tools).toHaveProperty('list_branches');
 });
});

describe('createMessageStream approval continuation', () => {
Expand Down

18 changes: 17 additions & 1 deletion
packages/web/src/ee/features/chat/agent.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -24,6 +24,7 @@ import { ANSWER_TAG, FILE_REFERENCE_PREFIX } from "@/features/chat/constants";
import { Source } from "@/features/chat/types";
import { addLineNumbers, fileReferenceToString, formatAttachmentsForPrompt, getAnswerPartFromAssistantMessage, getTurnProgressState, getUserMessageAttachments, getUserMessageText } from "@/features/chat/utils";
import { createTools } from "./tools";
import { createSkillDefinition, listSkillsDefinition, updateSkillDefinition } from "@/features/tools";
import { getConnectedMcpClients } from "@/ee/features/chat/mcp/mcpClientFactory";
import { getMcpTools, McpToolsResult } from "@/ee/features/chat/mcp/mcpToolSets";
import {
Expand DownExpand Up@@ -692,7 +693,22 @@ const createAgentStream = async ({
 skillRegistry,
 });

 const builtinTools = createTools({ source: 'sourcebot-ask-agent', selectedRepos: sortedRepos });
 const allBuiltinTools = createTools({ source: 'sourcebot-ask-agent', selectedRepos: sortedRepos });

 // The skill management tools require an interactive, authenticated
 // requester: same gate as load_skill. This also excludes programmatic runs
 // (askCodebase, /api/chat/blocking) where nobody can answer an approval
 // request.
 const skillManagementToolNames: string[] = [
 createSkillDefinition.name,
 updateSkillDefinition.name,
 listSkillsDefinition.name,
 ];
 const builtinTools: Record<string, Tool> = (userId !== undefined && orgId !== undefined)
 ? allBuiltinTools
 : Object.fromEntries(
 Object.entries(allBuiltinTools).filter(([name]) => !skillManagementToolNames.includes(name)),
 );
 const builtinToolNames = Object.keys(builtinTools);
 const allTools: Record<string, Tool> = {
 ...builtinTools,
Expand Down

11 changes: 11 additions & 0 deletions
packages/web/src/ee/features/chat/askCommandsContext.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
'use client';

import { createContext, useContext } from 'react';
import type { AskCommandDefinition } from '@/features/chat/commands/types';

// The chat page's server-rendered slash-command catalog, made available to
// nested chat components (e.g. the tool approval banner resolves a skill's
// display name from its slug + scope).
export const AskCommandsContext = createContext<AskCommandDefinition[]>([]);

export const useAskCommands = () => useContext(AskCommandsContext);

3 changes: 3 additions & 0 deletions
packages/web/src/ee/features/chat/components/chatThread/chatThread.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -33,6 +33,7 @@ import { McpReconnectContext } from '../../mcpReconnectContext';
import { McpAuthRequiredData, McpServerLoadFailureData, useMcpReconnectController } from './useMcpReconnectController';
import { McpReconnectBanner } from './mcpReconnectBanner';
import { ToolApprovalProvider } from '../../toolApprovalContext';
import { AskCommandsContext } from '../../askCommandsContext';
import useCaptureEvent from '@/hooks/useCaptureEvent';
import { SignInPromptBanner } from './signInPromptBanner';
import { DuplicateChatDialog } from '@/app/(app)/chat/components/duplicateChatDialog';
Expand DownExpand Up@@ -459,6 +460,7 @@ export const ChatThread = ({

 return (
 <ToolApprovalProvider value={addToolApprovalResponse}>
 <AskCommandsContext.Provider value={askCommands}>
 <McpReconnectContext.Provider value={mcpReconnectContextValue}>
 <McpServerIconContext.Provider value={mcpServerIconMap}>
 <McpToolNameContext.Provider value={mcpToolNameMap}>
Expand DownExpand Up@@ -615,6 +617,7 @@ export const ChatThread = ({
 </McpToolNameContext.Provider>
 </McpServerIconContext.Provider>
 </McpReconnectContext.Provider>
 </AskCommandsContext.Provider>
 </ToolApprovalProvider>
 );
}

184 changes: 184 additions & 0 deletions
packages/web/src/ee/features/chat/components/chatThread/detailsCard.test.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -194,6 +194,190 @@ describe('DetailsCard', () => {
 expect(screen.queryByText('Look for correctness issues first.')).toBeNull();
 });

 test('renders a create_skill success summary with the name and command', () => {
 const createSkillPart = {
 type: 'tool-create_skill',
 toolCallId: 'tool-call-create-skill',
 state: 'output-available',
 input: {
 name: 'Review PR',
 slug: 'review-pr',
 description: 'Review a pull request.',
 instructions: 'Look for correctness issues first.',
 },
 output: {
 output: '{}',
 metadata: {
 id: 'skill-1',
 slug: 'review-pr',
 name: 'Review PR',
 url: 'https://sourcebot.example.com/settings/skills?skill=skill-1',
 },
 },
 } satisfies SBChatMessagePart;

 const { container } = render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [createSkillPart] }]}
 />
 </TooltipProvider>
 );

 expect(container.textContent).toContain('Created skill');
 expect(container.textContent).toContain('Review PR');
 expect(container.textContent).toContain('/review-pr');
 expect(screen.queryByText('Creating skill...')).toBeNull();
 });

 test('renders an update_skill success summary with the name and command', () => {
 const updateSkillPart = {
 type: 'tool-update_skill',
 toolCallId: 'tool-call-update-skill',
 state: 'output-available',
 input: {
 slug: 'review-pr',
 scope: 'shared',
 name: 'Review PR v2',
 },
 output: {
 output: '{}',
 metadata: {
 id: 'skill-1',
 slug: 'review-pr',
 name: 'Review PR v2',
 scope: 'shared',
 url: 'https://sourcebot.example.com/settings/skills?skill=skill-1',
 },
 },
 } satisfies SBChatMessagePart;

 const { container } = render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [updateSkillPart] }]}
 />
 </TooltipProvider>
 );

 expect(container.textContent).toContain('Updated shared skill');
 expect(container.textContent).toContain('Review PR v2');
 expect(container.textContent).toContain('/review-pr');
 expect(screen.queryByText('Updating skill...')).toBeNull();
 });

 test('renders a list_skills count summary', () => {
 const listSkillsPart = {
 type: 'tool-list_skills',
 toolCallId: 'tool-call-list-skills',
 state: 'output-available',
 input: {},
 output: {
 output: '{"skills":[]}',
 metadata: { count: 3 },
 },
 } satisfies SBChatMessagePart;

 render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [listSkillsPart] }]}
 />
 </TooltipProvider>
 );

 expect(screen.queryByText('Listed skills')).toBeTruthy();
 expect(screen.queryByText('3 skills')).toBeTruthy();
 });

 test('shows a non-pulsing waiting state for an approval-requested tool call', () => {
 const approvalRequestedPart = {
 type: 'tool-create_skill',
 toolCallId: 'tool-call-approval',
 state: 'approval-requested',
 input: {
 name: 'Review PR',
 slug: 'review-pr',
 description: 'Review a pull request.',
 instructions: 'Look for correctness issues first.',
 },
 approval: { id: 'approval-1' },
 } satisfies SBChatMessagePart;

 render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={true}
 isNetworkActive={false}
 isAwaitingToolApproval={true}
 thinkingSteps={[{ stepIndex: 0, parts: [approvalRequestedPart] }]}
 />
 </TooltipProvider>
 );

 expect(screen.queryByText('Waiting for approval')).toBeTruthy();
 expect(screen.queryByText('Creating skill...')).toBeNull();
 });

 test('shows a denied label for an output-denied tool call', () => {
 const deniedPart = {
 type: 'tool-create_skill',
 toolCallId: 'tool-call-denied',
 title: 'Create skill',
 state: 'output-denied',
 input: {
 name: 'Review PR',
 slug: 'review-pr',
 description: 'Review a pull request.',
 instructions: 'Look for correctness issues first.',
 },
 approval: { id: 'approval-1', approved: false, reason: 'User denied' },
 } satisfies SBChatMessagePart;

 render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [deniedPart] }]}
 />
 </TooltipProvider>
 );

 expect(screen.queryByText('Create skill denied')).toBeTruthy();
 expect(screen.queryByText('Creating skill...')).toBeNull();
 });

 test('renders an unavailable skill load instead of a silent no-op', () => {
 const unavailableSkillPart = {
 type: 'tool-load_skill',
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
feat(web): add create_skill, update_skill, and list_skills tools to MCP and Ask Sourcebot#1612

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

jsourcebot
merged 4 commits into

from

Aug 20, 2026
 Merged


feat(web): add create_skill, update_skill, and list_skills tools to MCP and Ask Sourcebot
#1612
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


4 commits


Select commit
Hold shift + click to select a range
1c8368d

feat(web): add create_skill, update_skill, and list_skills tools to M…


jsourcebot Aug 20, 2026
aac1bb8

fix(web): reject repository-scoped access tokens in skill tools


jsourcebot Aug 20, 2026
6c0a779

docs: link skill tools changelog entry to PR


jsourcebot Aug 20, 2026
88c472f

docs: reword MCP skill tool sections in second person


jsourcebot Aug 20, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


1 change: 1 addition & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

### Added
- [EE] Added a `list_branches` tool to the MCP server and Ask Sourcebot for discovering repository branches and whether they are indexed. [#1609](https://github.com/sourcebot-dev/sourcebot/pull/1609)
- [EE] Added `create_skill`, `update_skill`, and `list_skills` tools to the MCP server and Ask Sourcebot for managing skills. [#1612](https://github.com/sourcebot-dev/sourcebot/pull/1612)

### Changed
- Migrated connection syncing, repository indexing, permission syncing, and background pruning from in-process managers and pollers to BullMQ workloads with retries and per-resource execution locking. [#1427](https://github.com/sourcebot-dev/sourcebot/pull/1427)
Expand Down

41 changes: 41 additions & 0 deletions
docs/docs/features/mcp-server.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -452,3 +452,44 @@ Parameters:
| `repos` | no | The repositories that are accessible to the agent during the chat. If not provided, all repositories are accessible. |
| `languageModel` | no | The language model to use for answering the question. Object with `provider` and `model`. If not provided, defaults to the first model in the config. Use `list_language_models` to see available options. |
| `visibility` | no | The visibility of the chat session (`'PRIVATE'` or `'PUBLIC'`). Defaults to `PRIVATE` for authenticated users and `PUBLIC` for anonymous users. Set to `PUBLIC` to make the chat viewable by anyone with the link (useful in shared environments like Slack). |

### `create_skill`

You can create an agent skill: a reusable set of instructions you invoke in Ask Sourcebot as a `/<slug>` slash command, or that the agent loads automatically when your request matches its description. The skill is personal to you and enabled immediately. The result includes a link to the skill in **Settings → Skills**.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:---------------|:---------|:------------|
| `name` | yes | Display name for the skill (1-80 characters). |
| `slug` | yes | Slash command for the skill, without the leading `/`. Lowercase letters, numbers, and hyphens; at most 64 characters. Must be unique among the user's skills. |
| `description` | yes | When to use the skill (1-500 characters). Used by the agent to auto-load the skill. |
| `instructions` | yes | Markdown instructions the agent follows when the skill is invoked (1-20,000 characters). |

### `update_skill`

You can edit an existing skill in place. Fields you omit keep their current values. You can edit your personal skills, and shared skills only if you created them and they are enabled. Skills synced from a repository file are rejected; edit those in **Settings → Skills**. This tool never enables or disables a skill, and never moves it between the personal and shared catalogs.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:---------------|:---------|:------------|
| `slug` | yes | Current slash command of the skill to update, without the leading `/`. |
| `scope` | yes | Which catalog the skill lives in: `personal` or `shared`. |
| `name` | no | New display name (1-80 characters). |
| `newSlug` | no | New slash command, without the leading `/`. Lowercase letters, numbers, and hyphens; at most 64 characters. |
| `description` | no | New description of when to use the skill (1-500 characters). |
| `instructions` | no | New markdown instructions (1-20,000 characters). |

### `list_skills`

You can list the skills visible to you: your personal skills plus your organization's shared catalog. Each row includes `slug` and `scope` (the pair `update_skill` needs), `enabled`, `isSynced` (linked to a repository file), `canEdit` (whether `update_skill` can edit it), and, on shared rows, `adopted`. Skill instructions are never included.

You need an authenticated user (API key or OAuth) and the Ask Sourcebot feature. Anonymous sessions and repository-scoped access tokens cannot use this tool.

Parameters:
| Name | Required | Description |
|:--------|:---------|:------------|
| `scope` | no | Filter to one catalog: `personal` or `shared`. Omit to list both. |

10 changes: 8 additions & 2 deletions
packages/web/src/app/api/(server)/ee/mcp/route.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -75,7 +75,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
 }

 const response = await sew(() =>
 withOptionalAuth(async ({ user }) => {
 withOptionalAuth(async ({ user, principal }) => {
 if (env.EXPERIMENT_ASK_GH_ENABLED === 'true' && !user) {
 return notAuthenticated();
 }
Expand DownExpand Up@@ -111,7 +111,13 @@ export const POST = apiHandler(async (request: NextRequest) => {
 },
 });

 const mcpServer = await createMcpServer();
 // Repository-scoped access tokens never get the skill management
 // tools: their documented authorization boundary is the selected
 // repositories only. The tools also reject scoped principals
 // per-request, since a session is keyed by owner, not principal.
 const mcpServer = await createMcpServer({
 canManageSkills: ownerId !== null && principal?.source !== 'scoped_access_token',
 });
 await mcpServer.connect(transport);

 return transport.handleRequest(request);
Expand Down

26 changes: 26 additions & 0 deletions
packages/web/src/ee/features/chat/agent.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -89,6 +89,9 @@ vi.mock('@/features/tools', () => {
 listReposDefinition: createToolDefinition('list_repos'),
 listTreeDefinition: createToolDefinition('list_tree'),
 readFileDefinition: createToolDefinition('read_file'),
 createSkillDefinition: createToolDefinition('create_skill'),
 updateSkillDefinition: createToolDefinition('update_skill'),
 listSkillsDefinition: createToolDefinition('list_skills'),
 toVercelAITool: vi.fn((definition: { name: string }) => ({
 name: definition.name,
 })),
Expand DownExpand Up@@ -273,6 +276,29 @@ describe('createMessageStream built-in tools', () => {
 expect(tools).toHaveProperty('list_branches');
 expect(activeTools).toContain('list_branches');
 });

 test('makes the skill management tools available to authenticated, interactive requesters', async () => {
 const { tools, activeTools } = await runCreateMessageStream([createUserMessage()], {
 userId: 'user-1',
 orgId: 1,
 });

 for (const toolName of ['create_skill', 'update_skill', 'list_skills']) {
 expect(tools).toHaveProperty(toolName);
 expect(activeTools).toContain(toolName);
 }
 });

 test('omits the skill management tools when the requester is anonymous or programmatic', async () => {
 const { tools, activeTools } = await runCreateMessageStream([createUserMessage()]);

 for (const toolName of ['create_skill', 'update_skill', 'list_skills']) {
 expect(tools).not.toHaveProperty(toolName);
 expect(activeTools).not.toContain(toolName);
 }
 // The other built-ins are unaffected by the gate.
 expect(tools).toHaveProperty('list_branches');
 });
});

describe('createMessageStream approval continuation', () => {
Expand Down

18 changes: 17 additions & 1 deletion
packages/web/src/ee/features/chat/agent.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -24,6 +24,7 @@ import { ANSWER_TAG, FILE_REFERENCE_PREFIX } from "@/features/chat/constants";
import { Source } from "@/features/chat/types";
import { addLineNumbers, fileReferenceToString, formatAttachmentsForPrompt, getAnswerPartFromAssistantMessage, getTurnProgressState, getUserMessageAttachments, getUserMessageText } from "@/features/chat/utils";
import { createTools } from "./tools";
import { createSkillDefinition, listSkillsDefinition, updateSkillDefinition } from "@/features/tools";
import { getConnectedMcpClients } from "@/ee/features/chat/mcp/mcpClientFactory";
import { getMcpTools, McpToolsResult } from "@/ee/features/chat/mcp/mcpToolSets";
import {
Expand DownExpand Up@@ -692,7 +693,22 @@ const createAgentStream = async ({
 skillRegistry,
 });

 const builtinTools = createTools({ source: 'sourcebot-ask-agent', selectedRepos: sortedRepos });
 const allBuiltinTools = createTools({ source: 'sourcebot-ask-agent', selectedRepos: sortedRepos });

 // The skill management tools require an interactive, authenticated
 // requester: same gate as load_skill. This also excludes programmatic runs
 // (askCodebase, /api/chat/blocking) where nobody can answer an approval
 // request.
 const skillManagementToolNames: string[] = [
 createSkillDefinition.name,
 updateSkillDefinition.name,
 listSkillsDefinition.name,
 ];
 const builtinTools: Record<string, Tool> = (userId !== undefined && orgId !== undefined)
 ? allBuiltinTools
 : Object.fromEntries(
 Object.entries(allBuiltinTools).filter(([name]) => !skillManagementToolNames.includes(name)),
 );
 const builtinToolNames = Object.keys(builtinTools);
 const allTools: Record<string, Tool> = {
 ...builtinTools,
Expand Down

11 changes: 11 additions & 0 deletions
packages/web/src/ee/features/chat/askCommandsContext.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
'use client';

import { createContext, useContext } from 'react';
import type { AskCommandDefinition } from '@/features/chat/commands/types';

// The chat page's server-rendered slash-command catalog, made available to
// nested chat components (e.g. the tool approval banner resolves a skill's
// display name from its slug + scope).
export const AskCommandsContext = createContext<AskCommandDefinition[]>([]);

export const useAskCommands = () => useContext(AskCommandsContext);

3 changes: 3 additions & 0 deletions
packages/web/src/ee/features/chat/components/chatThread/chatThread.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -33,6 +33,7 @@ import { McpReconnectContext } from '../../mcpReconnectContext';
import { McpAuthRequiredData, McpServerLoadFailureData, useMcpReconnectController } from './useMcpReconnectController';
import { McpReconnectBanner } from './mcpReconnectBanner';
import { ToolApprovalProvider } from '../../toolApprovalContext';
import { AskCommandsContext } from '../../askCommandsContext';
import useCaptureEvent from '@/hooks/useCaptureEvent';
import { SignInPromptBanner } from './signInPromptBanner';
import { DuplicateChatDialog } from '@/app/(app)/chat/components/duplicateChatDialog';
Expand DownExpand Up@@ -459,6 +460,7 @@ export const ChatThread = ({

 return (
 <ToolApprovalProvider value={addToolApprovalResponse}>
 <AskCommandsContext.Provider value={askCommands}>
 <McpReconnectContext.Provider value={mcpReconnectContextValue}>
 <McpServerIconContext.Provider value={mcpServerIconMap}>
 <McpToolNameContext.Provider value={mcpToolNameMap}>
Expand DownExpand Up@@ -615,6 +617,7 @@ export const ChatThread = ({
 </McpToolNameContext.Provider>
 </McpServerIconContext.Provider>
 </McpReconnectContext.Provider>
 </AskCommandsContext.Provider>
 </ToolApprovalProvider>
 );
}

184 changes: 184 additions & 0 deletions
packages/web/src/ee/features/chat/components/chatThread/detailsCard.test.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -194,6 +194,190 @@ describe('DetailsCard', () => {
 expect(screen.queryByText('Look for correctness issues first.')).toBeNull();
 });

 test('renders a create_skill success summary with the name and command', () => {
 const createSkillPart = {
 type: 'tool-create_skill',
 toolCallId: 'tool-call-create-skill',
 state: 'output-available',
 input: {
 name: 'Review PR',
 slug: 'review-pr',
 description: 'Review a pull request.',
 instructions: 'Look for correctness issues first.',
 },
 output: {
 output: '{}',
 metadata: {
 id: 'skill-1',
 slug: 'review-pr',
 name: 'Review PR',
 url: 'https://sourcebot.example.com/settings/skills?skill=skill-1',
 },
 },
 } satisfies SBChatMessagePart;

 const { container } = render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [createSkillPart] }]}
 />
 </TooltipProvider>
 );

 expect(container.textContent).toContain('Created skill');
 expect(container.textContent).toContain('Review PR');
 expect(container.textContent).toContain('/review-pr');
 expect(screen.queryByText('Creating skill...')).toBeNull();
 });

 test('renders an update_skill success summary with the name and command', () => {
 const updateSkillPart = {
 type: 'tool-update_skill',
 toolCallId: 'tool-call-update-skill',
 state: 'output-available',
 input: {
 slug: 'review-pr',
 scope: 'shared',
 name: 'Review PR v2',
 },
 output: {
 output: '{}',
 metadata: {
 id: 'skill-1',
 slug: 'review-pr',
 name: 'Review PR v2',
 scope: 'shared',
 url: 'https://sourcebot.example.com/settings/skills?skill=skill-1',
 },
 },
 } satisfies SBChatMessagePart;

 const { container } = render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [updateSkillPart] }]}
 />
 </TooltipProvider>
 );

 expect(container.textContent).toContain('Updated shared skill');
 expect(container.textContent).toContain('Review PR v2');
 expect(container.textContent).toContain('/review-pr');
 expect(screen.queryByText('Updating skill...')).toBeNull();
 });

 test('renders a list_skills count summary', () => {
 const listSkillsPart = {
 type: 'tool-list_skills',
 toolCallId: 'tool-call-list-skills',
 state: 'output-available',
 input: {},
 output: {
 output: '{"skills":[]}',
 metadata: { count: 3 },
 },
 } satisfies SBChatMessagePart;

 render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [listSkillsPart] }]}
 />
 </TooltipProvider>
 );

 expect(screen.queryByText('Listed skills')).toBeTruthy();
 expect(screen.queryByText('3 skills')).toBeTruthy();
 });

 test('shows a non-pulsing waiting state for an approval-requested tool call', () => {
 const approvalRequestedPart = {
 type: 'tool-create_skill',
 toolCallId: 'tool-call-approval',
 state: 'approval-requested',
 input: {
 name: 'Review PR',
 slug: 'review-pr',
 description: 'Review a pull request.',
 instructions: 'Look for correctness issues first.',
 },
 approval: { id: 'approval-1' },
 } satisfies SBChatMessagePart;

 render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={true}
 isNetworkActive={false}
 isAwaitingToolApproval={true}
 thinkingSteps={[{ stepIndex: 0, parts: [approvalRequestedPart] }]}
 />
 </TooltipProvider>
 );

 expect(screen.queryByText('Waiting for approval')).toBeTruthy();
 expect(screen.queryByText('Creating skill...')).toBeNull();
 });

 test('shows a denied label for an output-denied tool call', () => {
 const deniedPart = {
 type: 'tool-create_skill',
 toolCallId: 'tool-call-denied',
 title: 'Create skill',
 state: 'output-denied',
 input: {
 name: 'Review PR',
 slug: 'review-pr',
 description: 'Review a pull request.',
 instructions: 'Look for correctness issues first.',
 },
 approval: { id: 'approval-1', approved: false, reason: 'User denied' },
 } satisfies SBChatMessagePart;

 render(
 <TooltipProvider>
 <DetailsCard
 chatId="chat-id"
 isExpanded={true}
 onExpandedChanged={vi.fn()}
 isThinking={false}
 isTurnInProgress={false}
 isNetworkActive={false}
 isAwaitingToolApproval={false}
 thinkingSteps={[{ stepIndex: 0, parts: [deniedPart] }]}
 />
 </TooltipProvider>
 );

 expect(screen.queryByText('Create skill denied')).toBeTruthy();
 expect(screen.queryByText('Creating skill...')).toBeNull();
 });

 test('renders an unavailable skill load instead of a silent no-op', () => {
 const unavailableSkillPart = {
 type: 'tool-load_skill',
Expand Down
Loading
Loading